Cyber Incident Victim: Atlantis, Paradise Island
Date:
Mar 2016
Location:
Bahamas
Summary
Atlantis, Paradise Island experienced a malware-based security breach affecting credit and debit card transactions at its food, beverage, and retail outlets over several months. The compromise did not impact hotel reservation systems or purchases charged directly to guest rooms. Malware installed on point-of-sale systems captured card numbers, expiration dates, CVV codes, and occasionally cardholder names, though Social Security numbers and PINs remained unaffected. The resort initiated an investigation following alerts from its payment processor, leading to malware discovery and removal. Forensic experts confirmed the intrusion scope while the organization implemented enhanced security measures to prevent recurrence. Customers were advised to monitor financial statements for suspicious activity, with dedicated support channels established for inquiries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Atlantis, Paradise Island detected unauthorized activity involving customer payment card data following alerts from its credit card processor in 2016. The Resort initiated an investigation with third-party forensic experts, leading to the discovery of suspicious files on October 21, 2016. These files indicated potential compromise of credit and debit card information used at on-site food, beverage, and retail outlets between March 9 and October 22, 2016. Forensic analysis confirmed that malware had been deployed on point-of-sale systems, designed to capture payment card details during transactions. The malware specifically targeted cards physically swiped at affected merchant locations, excluding cards used for hotel reservations or purchases charged directly to guest rooms. Resort management contained the incident by removing the malicious software and implementing enhanced security protocols across their payment systems.
The compromised data included card numbers, expiration dates, CVV codes, and in some instances, cardholder names. Social Security numbers and PINs were not exposed, as the Resort did not collect this information. Atlantis publicly disclosed the breach on November 21, 2016, establishing a dedicated assistance line for affected customers and providing the reference number 1141111816 for inquiries. President Howard C. Karawan acknowledged the incident and advised customers to monitor financial statements for fraudulent activity. Forensic investigators continued assessing system security while the Resort maintained normal operations, confirming that payment systems were secure for future transactions following remediation. The breach exclusively impacted transactions processed at physical retail and dining locations during the seven-month exposure window.