Cyber Incident Victim: Kalahari Resorts
Date:
Dec 2015
Location:
United States of America
Summary
Kalahari Resorts experienced a point-of-sale breach affecting its Ohio and Wisconsin locations, where malware installed by an intruder captured customer payment card data—including card numbers, names, expiration dates, and verification codes—from specific outlets such as restaurants, bars, retail stores, and spas over a multi-month period. The resort engaged a forensic firm, notified the U.S. Secret Service, removed the malware, and provided security guidance to potentially impacted guests, though it did not offer credit monitoring; this incident followed another nearby resort breach earlier the same year.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In late October 2015, Kalahari Resorts, based in Wisconsin Dells, Wisconsin, discovered unauthorized access to point-of-sale (POS) systems at its Ohio and Wisconsin resort locations. The breach occurred between May 18, 2015, and November 9, 2015, affecting payment terminals at specific resort outlets including restaurants, bars, retail stores, and spa facilities. An intruder installed malware designed to capture payment card data from these systems, though the front desk POS infrastructure remained uncompromised. The malware targeted customer card numbers, cardholder names, expiration dates, and verification codes processed through the impacted terminals. Kalahari officials publicly disclosed the incident on December 7, 2015, but did not specify the number of affected individuals. This marked the second payment card breach at a Wisconsin Dells resort within months, following a March-June 2015 incident at Wilderness Resort.
Upon detecting the intrusion, Kalahari immediately engaged a forensic firm to analyze its systems and contain the threat. The company removed the malware and notified the U.S. Secret Service to assist with the investigation. Kalahari spokeswoman Samantha Flynn confirmed the organization followed all notification protocols and emphasized ongoing efforts to enhance system security. The resort provided security guidance to potentially affected guests through a dedicated FAQ but did not offer complimentary credit monitoring services. Forensic analysis determined the breach was limited to specific transactional environments, with no evidence of broader network infiltration beyond the identified POS terminals.