IT Security Stories to Watch: Hilton Identifies Malware Intrusion

Hilton Hotels and Resorts (HLT) has discovered malicious software on point-of-sale (POS) systems at some of its properties. 

And as a result, the hotel chain tops this week’s list of IT security newsmakers, followed by VTech, Hungryhouse and the ModPOS malware.

What can managed service providers (MSPs) and their customers learn from these IT security newsmakers? Check out this week’s edition of IT Security Stories to Watch to find out:

1. Hilton’s malware intrusion: Here’s what you need to know

Hilton has launched an investigation into a malware intrusion involving some of its POS systems that may have affected customers between Nov. 18 to Dec. 5, 2014 and April 21 to July 27, 2015.

The hotel chain said compromised information may have included payment card numbers, cardholder names, security codes and expiration dates. However, Hilton noted that customer addresses and personal identification numbers were unaffected.

“Hilton Worldwide has identified and taken action to eradicate unauthorized malware that targeted payment card information in some point-of-sale systems,” the company told Krebs on Security. “Hilton immediately launched an investigation and has further strengthened its systems.”

2. VTech notifies customers about cyber attack

VTech said an unauthorized party accessed customer data housed on its Learning Lodge app store database on Nov. 14. 

The company’s customer database includes customer names, email addresses and other user profile information. 

VTech is investigating the incident and exploring ways to enhance its Learning Lodge database security.

3. Hungryhouse resets customers’ passwords

Hungryhouse has reset thousands of customers’ passwords after a data breach at a third-party web hosting company.

The UK-based online food ordering platform provider noted it reset some of its customers’ passwords after it found customer information was leaked by the web hosting company. 

“We had no affiliation with the web hosting company that was hit by a data breach. When our head of security noticed that a number of our customers’ details appeared on the list of emails that had been breached, we took the preemptive step of asking them to change their passwords,” Hungryhouse CEO Scott Fletcher told The Register. 

4. iSIGHT Partners: Beware ModPOS malware

Cyber threat intelligence provider iSIGHT Partners has identified a sophisticated POS malware that has already been used to target US-based retailers.

iSIGHT Partners said the malware, called ModPOS, frequently goes undetected by security defenses and may have ties to Eastern Europe as well. 

“In a nutshell, this is not your daddy’s run-of-the-mill cyber crime malware,” iSIGHT Partners said in a prepared statement. “We are making the ModPOS details and technical indicators publicly available in an effort to protect future victims and provide retailers and other POS and payment system operators the information they need to hunt for the ModPOS malware in their environments.”

What are your thoughts on this week’s IT security stories to watch? Share your thoughts about this story in the Comments section below, via Twitter @dkobialka or email me at [email protected].