Kimpton Hotels and Restaurants has admitted that 60 of their 64 properties were hit by a Payment Card Terminal or Point of Sale Malware infection. The Kimpton Hotel Data Breach affected card processing servers within the Kimpton properties in 60 out of their total 64 properties, across 33 states.
Kimpton joins an ever growing list of hotel brands that have acknowledged credit card breaches over the last year, including Hilton Hotels, Trump Hotels (twice), Mandarin Oriental, and White Lodging (twice). Breaches also have hit hospitality chains Starwood Hotels and Hyatt, plus Millennium Hotels & Resorts North America and Noble House Hotels and Resorts.
Kimpton’s Breach Notification statement contains the following statement:
Kimpton Hotels & Restaurants received a report on July 15, 2016 of unauthorized charges occurring on payment cards after they had been used by guests at the restaurant in one of our hotels. We immediately began to investigate the report and hired leading cyber security firms to examine our payment card processing system. Findings from the investigation show that malware was installed on servers that processed payment cards used at the restaurants and front desks of some of our hotels. The malware searched for track data read from the magnetic stripe of a payment card as it was being routed through the affected server. The malware primarily found track data that contained the card number, expiration date, and internal verification code, but in a small number of instances it may have found the track that also contains the cardholder name.
A list of affected Kimpton Hotel properties affected by the POS Malware can be found here:
- 70 Park Avenue Hotel, New York, NY, 2/16/16 – 6/15/16
(no restaurant affected) - Alexis Hotel, Seattle, WA, 2/19/16 – 7/6/16
(Library Bistro & Bookstore Bar), Seattle, WA, 2/16/16 – 3/1/16 - Amara Resort, Sedona, AZ, 2/16/16 – 5/8/16
(no restaurant affected) - Canary Hotel, Santa Barbara, CA, 2/18/16 – 7/6/16
(Finch & Fork), Santa Barbara, CA 2/16/16 – 2/24/16 - Carlyle Hotel – Dupont Circle, Washington DC, 2/16/16 – 7/6/16
(no restaurant affected) - Epic Hotel, Miami, FL, 2/16/16 – 7/6/16
(Area 31), Miami, FL, 2/16/16 – 3/1/16 - Eventi, New York, NY, 2/16/16 – 7/6/16
(In Room Dining), New York, NY, 2/16/16 – 2/25/16 - FireSky Resort & Spa, Scottsdale, AZ, 2/19/16 – 4/11/16
(no restaurant affected) - Glover Park Hotel (Former Savoy Suites), Washington DC, 2/16/16 – 7/6/16
(no restaurant affected) - Grand Hotel Minneapolis, Minneapolis, MN, 2/16/16 – 3/15/16
(The Six15 Room), Minneapolis, MN, 2/16/16 – 7/7/16 - Hotel Allegro, Chicago, IL, 2/16/16 – 7/6/16
(312 Chicago), Chicago, IL, 2/16/16 – 7/7/16 - Hotel Burnham, Chicago, IL, 2/16/16 – 7/6/16
(Atwood Cafe), Chicago, IL, 2/16/16 – 2/24/16 - Hotel George, Washington DC, 2/19/16 – 7/6/16
(no restaurant affected) - Hotel Lumen, Dallas, TX, 2/19/16 – 7/6/16
(no restaurant affected) - Hotel Madera, Washington DC, 2/19/16 – 7/6/16
(Firefly), Washington DC, 2/16/16 – 7/7/16 - Hotel Marlowe, Boston/Cambridge, MA, 2/16/16 – 7/6/16
(Bambara-Cambridge), Boston/Cambridge, MA, 2/16/16 – 2/24/16 - Hotel Monaco Alexandria, Alexandria, VA, 2/19/16 – 7/6/16
(Jackson 20), Alexandria, VA, 2/16/16 – 2/25/16 - Hotel Monaco Baltimore, Baltimore, MD, 2/16/16 – 7/6/16
(B&O American Brasserie), Baltimore, MD, 2/16/16 – 2/24/16 - Hotel Monaco Chicago, Chicago, IL, 2/18/16 – 7/6/16
(no restaurant affected) - Hotel Monaco DC, Washington DC, 2/16/16 – 7/6/16
(Poste Brasserie), Washington DC, 2/16/16 – 2/17/16 - Hotel Monaco Denver, Denver, CO, 2/16/16 – 7/6/16
(Panzano), Denver, CO, 2/16/16 – 2/24/16 - Hotel Monaco Philadelphia, Philadelphia, PA, 2/18/16 – 7/6/16
(Red Owl, Stratus), Philadelphia, PA, 2/16/16 – 3/15/16 - Hotel Monaco Pittsburgh, Pittsburgh, PA, 2/16/16 – 7/6/16
(Biergarten/Commoner), Pittsburgh, PA, 2/16/16 – 2/23/16 - Hotel Monaco Portland, Portland, OR, 2/19/16 – 7/6/16
(Red Star Tavern & Roast House), Portland, OR, 2/16/16 – 7/6/16 - Hotel Monaco Salt Lake City, Salt Lake City, UT, 2/18/16 – 7/6/16
(Bambara-Salt Lake City), Salt Lake City, UT, 2/16/16 – 2/24/16 - Hotel Monaco Seattle, Seattle, WA, 2/19/16 – 7/6/16
(no restaurant affected) - Hotel Palomar Chicago, Chicago, IL, 2/16/16 – 7/6/16
(Sable), Chicago, IL, 2/16/16 – 3/14/16 - Hotel Palomar DC, Washington DC, 2/18/16 – 7/6/16
(Urbana), Washington DC, 2/16/16 – 2/24/16 - Hotel Palomar LA-Beverly Hills, Los Angeles, CA 2/16/16 – 7/6/16
(BLVD16), Los Angeles, CA 2/16/16 – 2/24/16 - Hotel Palomar Philadelphia, Philadelphia, PA, 2/16/16 – 7/6/16
(Square 1682), Philadelphia, PA, 2/16/16 – 2/29/16 - Hotel Palomar San Diego, San Diego, CA, 2/16/16 – 7/7/16
(Saltbox), San Diego, CA, 2/16/16 – 7/5/16 - Hotel Rouge, Washington DC, 2/19/16 – 7/6/16
(Rouge Bar), Washington DC, 2/16/16 – 7/7/16 - Hotel Solamar, San Diego, CA 2/16/16 – 7/6/16
(Jsix/Lounge Six), San Diego, CA 2/16/16 – 2/24/16 - Hotel Van Zandt, Austin, TX, 2/16/16 – 7/6/16
(Geraldines), Austin, TX, 2/16/16 – 2/29/16 - Hotel Vintage Portland, Portland, OR, 2/18/16 – 7/6/16
(Bacchus Bar), Portland, OR, 2/16/16 – 3/1/16 - Hotel Vintage Seattle, Seattle, WA, 2/18/16 – 7/6/16
(Tulio), Seattle, WA, 2/18/16 – 3/1/16 - Hotel Wilshire, Los Angeles, CA, 2/18/16 – 7/6/16
(no restaurant affected) - Hotel Zamora, St Pete Beach, FL, 2/16/16 – 7/6/16
(no restaurant affected) - Ink48, New York, NY, 2/16/16 – 7/6/16
(In Room Dining), New York, NY, 2/16/16 – 2/25/16 - Lorien Hotel & Spa, Alexandria, VA, 2/16/16 – 7/6/16
(BRABO), Alexandria, VA, 2/16/16 – 2/24/16 - Mason & Rook, Washington DC, 4/5/16 – 7/6/16
(no restaurant affected) - Morrison House, Alexandria, VA, 4/20/16 – 7/6/16
(The Grille), Alexandria, VA, 2/16/16 – 7/7/16 - Nine Zero Hotel, Boston/Cambridge, MA, 2/19/16 – 7/6/16
(no restaurant affected) - Onyx Hotel, Boston/Cambridge, MA, 2/16/16 – 7/6/16
(no restaurant affected) - Palladian Hotel, Seattle, WA, 2/19/16 – 7/6/16
(Shaker & Spear / Penny Royal), Seattle, WA, 2/16/16 – 2/24/16 - Palomar Phoenix Cityscape, Phoenix, AZ, 2/18/16 – 7/6/16
(Blue Hound), Phoenix, AZ, 2/16/16 – 2/24/16 - Riverplace, Portland, OR, 2/16/16 – 7/5/16
(Three Degrees Waterfront Bar & Grill), Portland, OR, 2/16/16 – 2/24/16 - Schofield Hotel, Cleveland, OH, 2/16/16 – 7/6/16
(no restaurant affected) - Shorebreak Hotel, Huntington Beach, CA, 2/19/16 – 7/6/16
(Zimzala), Huntington Beach, CA, 2/16/16 – 2/24/16 - Sir Francis Drake Hotel, San Francisco, CA, 2/19/16 – 7/6/16
(no restaurant affected) - Sky Hotel, Aspen, CO, 2/16/16 – 7/6/16
(no restaurant affected) - Taconic Hotel, Manchester Village, VT, 2/16/16 – 7/6/16
(Copper Grouse), Manchester Village, VT, 2/16/16 – 3/16/16 - The Anglers Hotel (not affected)
(660 at the Anglers), Miami, FL, 2/16/16 – 4/28/16 - The Brice, Savannah, GA, 2/19/16 – 7/6/16
(Pacci), Savannah, GA, 2/16/16 – 7/7/16 - The Buchanan Hotel, San Francisco, CA, 2/16/16 – 7/6/16
(no restaurant affected) - The Cardinal, Winston-Salem, NC, 2/16/16 – 7/6/16
(no restaurant affected) - The Goodland, Santa Barbara, CA, 2/18/16 – 7/6/16
(Outpost/Goodbar), Santa Barbara, CA, 2/16/16 – 2/29/16 - The Muse New York, New York, NY, 2/16/16 – 7/6/16
(no restaurant affected) - The Surfcomber South Beach, Miami, FL, 2/16/16 – 7/6/16
(Social Club), Miami, FL, 2/16/16 – 2/24/16 - Tideline Ocean Resort & Spa, Palm Beach, FL, 2/16/16 – 7/6/16
(Brandon’s/Mizu), Palm Beach, FL, 2/16/16 – 7/6/16 - Topaz Hotel, Washington DC, 2/19/16 – 7/6/16
(no restaurant affected) - Vero Beach Hotel & Spa, Vero Beach, FL, 2/16/16 – 7/7/16
(Cobalt/Heaton’s Reef), Vero Beach, FL, 2/16/16 – 7/5/16
This list may grow, but as Kimpton have been working on this list for about a month, it might be complete (at this time).