2012-07-01
Abstract
FTC says data breaches occurred as a result of group failing to maintain reasonable security on its networks.
Copyright © 2012 Virus Bulletin
Large hotel group Wyndham has been fined by the FTC for data breaches that resulted in the loss of hundreds of thousands of customers’ confidential data.
The FTC claims that Wyndham failed to maintain ‘reasonable security’ on its networks, thus allowing a series of data breaches to occur.
According to the FTC’s complaint, the hotel group failed to adequately protect a property management system used to manage 7,000+ hotels under the Wyndham Hotels and Resorts umbrella. Among other things, it is believed that default administrative usernames and passwords were used on servers that connected to the network.
In addition, Wyndham Worldwide – the hotel group’s parent company – stored customer credit card data in plain text, and did not adequately segregate the property management system from the company’s intranet and the public Internet. As a result, a string of security breaches occurred between April 2008 and January 2010, and customer data was stolen.
The company says it has improved its information security practices and that it plans to challenge the suit.
