Hackers steal thousands of Wyndham credit card numbers

The company estimates that 41 Wyndham hotels and resorts were affected.

Hackers broke into a computer at Wyndham Hotels and Resorts last July and stole tens of thousands of customer credit card numbers, the hotel chain has warned.

The break-in occurred at a property belonging to a Wyndham franchisee, but that computer was linked to other company systems. "That intrusion enabled a hacker to use the company server to search for customer information located at other franchised and managed property sites," the company said in a statement disclosing the breach.

The data was then uploaded to a Web site during July and August of 2008, Wyndham said. The company estimates that 41 Wyndham hotels and resorts were affected by the breach before it was discovered by the company's information security team in mid-September. The incident did not affect other Wyndham properties, such as Days Inn, Ramada or Super 8.

Wyndham has not said how many guests were affected by the theft, but it may have affected as many as 21,000 customers in Florida, according to the state's attorney general. Wyndham representatives did not return calls seeking comment on the breach.

The criminals were able to get guest names, credit card numbers and their expiration dates, as well as data from the cards' magnetic stripe, Wyndham said.

Magnetic stripe information, sometimes called a card verification value (CVV) code, is critical if the thieves want to make fake credit cards, according to Avivah Litan, an analyst at Gartner Inc.

"That's the hot information," she said. "You can sell that information for much more on the black market." CVV codes were also taken in the high-profile Heartland Payment Systems Inc. and The TJX Companies Inc. credit card thefts.

When fraud is perpetrated using fake cards that include the CVV codes, the banks are responsible for the charges; when the fraudsters have only the card numbers and expiration dates -- the information used in online transactions, for example -- then the retailer is responsible for the charges. "The banking industry is all up in arms whenever bank stripe data is stolen," Litan said.

After an eight-week investigation, Wyndham notified credit card companies and the U.S. Secret Service, which investigates financial crimes. Customers were made aware of the breach in December. Last week, it posted more details about the incident on its Web site. (http://www.wyndhamworldwide.com/customer_care/data-claim.cfm)

Source: IDG