Presidential candidate and real-estate baron Donald Trump’s chain of high-end hotels “may have been the victim of a data security incident”, the company has informed customers.
Trump Hotel Collection (THC) executives ascribed the breach to malware that was active on its systems “between May 19, 2014, and June 2, 2015”.
“[W]e believe that the malware may have affected payment card data including payment card account number, card expiration date and security code,” the company said in a statement.
On the frequently-asked-questions page, the company detailed the nature of the breach and noted that it had not stored credit cards in a cache that had then been stolen. Instead, “the malware may have accessed payment card information in real-time as it was being inputted into our systems”.
The company’s acknowledgement of the breach comes roughly three months after security expert Brian Krebs first reported that multiple financial institutions suspected the hotels were compromised.
The Trump hack is the third data breach announced in the last week – discount brokerage Scottrade announced to customers that it had been breached last week, and on Thursday data giant Experian said it had also been breached, compromising some 15 million T-Mobile customers.
There is a strong incentive to steal exactly this kind of data, said Rurik Bradbury, chief marketing officer of Trustev, a data security firm. “It ‘weighs’ very little and it costs a lot,” Bradbury said. “They just need to find one entry point and they can pull out a lot of data.”
Bradbury said he had also seen an uptick in the sale of information of this kind on the deep web immediately after recent hacks, often in the form of “fullz” – complete sets of identifying information, not just credit card numbers.
“Usually this data gets chopped up and sold as quickly as possible through a number of forums; the sooner you can do it, the more valuable it is,” Bradbury said.
