Hilton Worldwide Holdings Inc. on Tuesday said it suffered a security breach related to customer credit and debit card payments at its hotels, prompting the company to launch a global investigation to determine how far the breach had spread.
The McLean, Va., company becomes the latest hotel operator to be hacked during a recent flurry of security breaches over the past two years. Hilton’s announcement comes just days after Starwood Hotels & Resorts Worldwide Inc. said hackers had stolen customer credit-card and debit-card information in a breach that lasted nearly eight months at 54 locations.
The Trump Hotel Collection and Mandarin Oriental Hotel Group are among the other brands that previously warned guests about potential security breaches.
At Hilton, it is unclear how many of its 4,500 hotels world-wide have been affected. The company is asking all its guests who stayed at Hilton properties from during certain dates in November and December last year, and from April 21 to July 27, 2015, to review their payment card statements for signs of fraud.
Hilton said malicious software, known as malware, infiltrated payments systems at hotel restaurants, gift shops and other hotel locations with registers. The malware may have collected customer names, card numbers, security codes and expiration dates, Hilton said.
“Hilton Worldwide worked closely with third-party forensics experts, law enforcement and payment card companies on this investigation, and determined that specific payment card information was targeted by this malware,” the company said Tuesday in a statement. “Hilton immediately launched an investigation and has further strengthened its systems.”
The breach highlights a security weakness at many hotels, which have proven vulnerable to hackers who target point-of-sale devices.
Consumers aren’t liable for unauthorized purchases made on their cards, but breaches can sometimes enable hackers to use the information to create counterfeit cards.—Maria Armental contributed to this article. Corrections & Amplifications
Hilton Worldwide on Tuesday reported hackers gained access to its payment system. An earlier version of this article incorrectly stated that data had been stolen.