The Trump Hotel Collection

Summary

The Trump Hotel Collection experienced a cybersecurity breach involving unauthorized access to payment systems across multiple properties. Malware was deployed on point-of-sale systems, compromising credit card data including numbers, expiration dates, and security codes from transactions. The intrusion persisted for over a year before detection, affecting guests at various locations. Third-party forensic experts assisted in investigating the incident and containing the malware. Affected customers were notified and advised to review account statements for fraudulent activity, while the organization reinforced security protocols to prevent future breaches.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Trump Hotel Collection data breach was publicly disclosed on July 11, 2017, though forensic investigations indicated unauthorized access to payment systems had persisted for over a year prior to detection. Attackers deployed malware designed to harvest payment card data from point-of-sale systems across 14 luxury hotel properties in the United States, Canada, and Panama. The malicious software captured cardholder names, account numbers, expiration dates, and verification codes during transactions processed between May 19, 2016, and June 2, 2017. Forensic evidence suggested intermittent periods of attacker activity rather than continuous network presence, with multiple intrusion attempts preceding the establishment of persistent access.

Hotel management initiated an investigation upon detecting anomalous network traffic patterns in June 2017, engaging third-party cybersecurity experts to conduct forensic analysis. The probe revealed compromised payment systems at specific transactional locations including front desks, restaurants, bars, and spa facilities. Notification letters were dispatched to potentially affected customers beginning July 11, 2017, advising them to review account statements for fraudulent charges. The company offered twelve months of complimentary credit monitoring services through Kroll and established a dedicated call center for customer inquiries. Financial institutions received technical indicators of compromise to facilitate fraud detection, while law enforcement agencies including the U.S. Secret Service were notified of the intrusion. No operational disruptions occurred at hotel properties during the investigation period, though the incident prompted system-wide security enhancements including point-to-point encryption implementation and network segmentation of payment processing environments.

Sources

Sources available to members: 1 source.