Hackers broke into a computer at Wyndham Hotels and Resorts last July and stole tens of thousands of customer credit card numbers, the hotel chain has warned.
The break-in occurred at a property belonging to a Wyndham franchisee, but that computer was linked to other company systems. "That intrusion enabled a hacker to use the company server to search for customer information located at other franchised and managed property sites," the company said in a statement disclosing the breach.
The data was then uploaded to a Web site during July and August of 2008, Wyndham said. The company estimates that 41 Wyndham hotels and resorts were affected by the breach before it was discovered by the company's information security team in mid-September. The incident did not affect other Wyndham properties, such as Days Inn, Ramada or Super 8.
Wyndham hasn't said how many guests were affected by the theft, but it may have affected as many as 21,000 customers in Florida, according to the state's attorney general. Wyndham representatives didn't return calls seeking comment on the breach.
The criminals were able to get guest names, credit card numbers and their expiration dates, as well as data from the cards' magnetic stripe, Wyndham said.
Magnetic stripe information includes a so-called card verification value (CVV) code used for security purposes during in-person transactions. (A similar code, called CVV2, is printed on the back of cards for use in card-not-present transactions, such as purchases made online or via the phone.) Obtaining the CVV1 data from the magnetic stripe is critical if identity thieves want to make fake credit cards, according to Avivah Litan, an analyst at Gartner Inc.
"That's the hot information," she said. "You can sell that information for much more on the black market."
CVV1 codes were among the information taken in the high-profile data breach disclosed in January 2007 by The TJX Companies Inc., and a spokesman at Heartland Payment Systems Inc. said that CVV1 data "may have been compromised" in the breach reported last month by the Princeton, N.J.-based payment processor. He added, though, that no CVV2 codes were stolen from Heartland's systems.
When fraud is perpetrated using fake cards that include the CVV codes, the banks are responsible for the charges; when the fraudsters have only the card numbers and expiration dates — all the information that sometimes is required for online transactions — then the retailer is responsible for the charges. "The banking industry is all up in arms whenever bank stripe data is stolen," Litan said.
Wyndham said it notified the U.S. Secret Service soon after detecting the breach but waited until after an eight-week investigation to inform customers, finally contacting them in December. Last week, the company posted more details about the incident on its Web site.
(Editor's note: This story was updated at about 6:50 p.m. EST on Feb. 23 to correct inaccurate information about the timing of Wyndham's breach notification to the Secret Service.)