Cyber Incident Victim: Hilton Worldwide Holdings Inc.
Date:
Apr 2015
Location:
United States of America
Summary
A cybersecurity incident involving Hilton Hotels impacted point-of-sale systems across multiple properties, including Embassy Suites, Doubletree, Hampton Inn, and Waldorf Astoria locations. Banking institutions identified fraudulent credit card activity traced to compromised payment terminals within on-site restaurants, gift shops, and coffee bars, with indications the breach persisted over an extended period. The hotel chain confirmed an investigation into the potential compromise but did not disclose specifics regarding scope or duration. Unlike reservation platforms, the breach appeared isolated to franchised retail and dining outlets. Financial sector analysts suggested the intrusion might have spanned several months prior to detection, though the full extent remained unconfirmed during initial inquiries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In mid-to-late 2015, multiple financial institutions identified a pattern of credit card fraud linked to point-of-sale systems at Hilton Hotel properties across the United States. Banking industry sources traced the fraudulent activity to purchases made at Hilton-owned and franchised locations, including Embassy Suites, Doubletree, Hampton Inn and Suites, and Waldorf Astoria Hotels & Resorts. Visa had issued confidential alerts to banks in August 2015 regarding a breach at an unnamed brick-and-mortar merchant, with compromised cards showing transactions between April 21 and July 27, 2015. Forensic analysis by five separate financial institutions later determined Hilton properties were the common point of exposure for all cards listed in Visa’s alert. Hilton Worldwide acknowledged the investigation in a public statement, emphasizing its commitment to protecting customer data and collaboration with security experts, but did not confirm the breach’s validity or scope at the time of reporting.
The breach specifically targeted point-of-sale devices in on-site restaurants, coffee bars, and gift shops rather than Hilton’s central reservation systems, mirroring previous incidents at Mandarin Oriental and White Lodging hotel properties. Banking sources indicated the compromise potentially began as early as November 2014 and might have persisted beyond July 2015, though neither Hilton nor Visa disclosed the number of affected locations or payment cards. Financial institutions absorbed costs from fraudulent transactions tied to the incident while awaiting conclusive findings from Hilton’s internal investigation. The company maintained standard data security protocols during the inquiry but did not implement additional public mitigation measures during the initial reporting period. No attacker methodologies or data exfiltration vectors were confirmed by Hilton or law enforcement in available disclosures.