Cyber Incident Victim: Milestone Hospitality Management
Date:
Jun 2015
Location:
United States of America
Summary
Milestone Hospitality Management experienced a malware infection impacting its Holiday Inn Harrisburg/Hershey property management system, potentially compromising guest names, addresses, credit card details, expiration dates, and CVV codes. The company took steps to remediate the issue, enhance system security, and notified affected individuals while offering complimentary credit monitoring and identity restoration services, though no actual misuse of information was confirmed.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Milestone Hospitality Management disclosed a cybersecurity incident involving malware that potentially compromised guest payment card data at the Holiday Inn Harrisburg/Hershey. The company detected unauthorized activity on July 22, 2015, initiating an investigation that revealed malware had infiltrated the hotel's property management computer system. This system breach persisted from June 2 through July 10, 2015, exposing transactional data processed during that 39-day window. The compromised information included guests' names, addresses, credit card account numbers, expiration dates, and CVV security codes. While the exact number of affected individuals remains undisclosed, the breach impacted all guests who provided payment details at the Pennsylvania hotel during the infection period. Forensic analysis confirmed the malware specifically targeted cardholder data flowing through the compromised systems. Milestone emphasized in notifications that they had no evidence of actual misuse of the stolen information at the time of disclosure.
Upon confirming the breach, Milestone implemented remediation measures to eliminate the malware and strengthen system security protocols. The company began notifying potentially affected guests on August 14, 2015, through mailed letters that detailed the incident's scope and recommended protective actions. Offered remedies included complimentary credit monitoring and identity restoration services for twelve months. Milestone's public notification stressed the importance of vigilance regarding financial statements while acknowledging no verified fraudulent activity stemming from the breach. The hospitality firm coordinated with cybersecurity professionals to address vulnerabilities and prevent recurrence, though specific technical countermeasures were not publicly disclosed. Guests were advised to review account statements and credit reports for unauthorized transactions, reflecting standard post-breach guidance in payment card compromise scenarios.