Cyber Incident Victim: The Houstonian Hotel, Club & Spa
Date:
Dec 2013
Location:
United States of America
Summary
A malicious software attack compromised payment processing systems at The Houstonian Hotel, Club & Spa for approximately six months, exposing customers' payment card data. More than 10,000 individuals were notified following an investigation prompted by law enforcement notification. The establishment replaced breached systems, restricted server access, engaged a forensics firm to bolster security, and provided affected customers with complimentary credit monitoring for one year. The response delay was attributed to ensuring comprehensive containment before public disclosure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Houstonian Hotel, Club & Spa in Texas experienced a payment card data breach affecting over 10,000 customers after malicious software compromised its payment processing systems for approximately six months. The breach began on December 28, 2013, and continued until June 20, 2014, with the hotel receiving notification from the U.S. Secret Service about the incident on June 10. Hotel management delayed public disclosure and filing a police report until July 2014, approximately four weeks after initial notification, citing the need to verify complete containment of the breach before alerting customers. Jason Love, the hotel's information technology director, explained this decision by stating they lacked "absolute certainty" about having stopped all malicious activity and wanted comprehensive information before engaging affected members. Forensic analysis determined attackers used malware to infiltrate the payment systems, though the exact number of compromised transactions remained unspecified despite exceeding the 10,000 confirmed notification threshold.
In response to the breach, The Houstonian Hotel implemented extensive remediation measures including complete replacement and overhaul of the compromised payment processing infrastructure. The organization restricted server access across its network and retained a digital forensics firm to strengthen security protocols. Affected customers received email notifications detailing the exposure of their payment card data and were offered complimentary credit monitoring services for one year. The hotel's containment efforts focused on eliminating the malware infection while preserving transaction records for investigative purposes. No additional attacker methodologies or specific malware variants were disclosed in available reports, with remediation timelines aligning closely with the breach's June 20 termination date.