Omni Hotels & Resorts has announced that 80 percent of their North American hotels had their point-of-sale systems compromised by malware between December 23, 2015 and June 14, 2016. It is believed that payment card information for more than 50,000 Omni customers may have been compromised due to this breach.

Announced: July 8, 2016

Description of the breach: From December 23, 2015 through June 14, 2016, a majority of Omni Hotels & Resorts’ point-of-sale systems were infected with malware. This malicious code was used to collect cardholder names, credit/debit card numbers, security codes, and expiration dates. Omni has stated that they are confident only cards that were physically presented for payment are at risk of being compromised. Their reservation and Select Guest membership systems were not breached.

Omni Hotels & Resorts is encouraging individuals who physically presented their card at the hotel to monitor their accounts and credit reports for fraudulent activity. Customers are being asked to immediately contact their bank or card issuer should they spot any fraudulent activity.  

Omni Hotels & Resorts is offering one year of free identity theft protection to all affected guests. The coverage offers identity theft monitoring and a $1 million identity theft insurance package. To take advantage of this offer, Omni Hotels & Resorts requests that customers contact them at 1-855-303-9809.

Data breach period: December 23, 2015 – June 14, 2016

Affected customers: More than Omni 50,000 customers.

Official information from Omni Hotels & Resorts: https://www.omnihotels.com/notice

Contact Omni Hotels & Resorts: 1-855-303-9809 (for free identity theft protection), https://www.omnihotels.com/contact-us

More coverage of this breach: Wall Street Journal

The restaurant chain Noodles & Company has announced that the payment information of an undisclosed number of customers has been compromised. Customers who used their credit or debit card at one of the affected stores in 27 states and the District of Columbia are being advised to take precautions against fraud. The breach occurred as a result of malware installed on a Noodles & Company store’s register between January 31, 2016 and June 2, 2016.

Announced: June 28, 2016

Description of the breach: Beginning in January 2016, Noodles & Company restaurants in 27 states and the District of Columbia were affected by point-of-sale malware targeting payment card information. Affected stores had malware living on their registers and collecting sensitive customer data between January 31, 2016 and June 2, 2016. The malware collected data such as the cardholder’s name, card number, expiration date, and CVV. To see if a Noodles & Company restaurant near you was affected, access the full list of affected restaurants by clicking here.

Although the breach has been contained, and all stores are now safe to use credit or debit cards, Noodles & Company patrons are being urged to monitor their credit report and credit/debit cards for fraudulent activity. Noodles & Company is also urging affected customers to consider placing a fraud alert or credit freeze on their account. Placing a fraud alert on your account requires creditors to take extra steps to verify your identity before granting credit in your name. A credit freeze prevents access to your credit report until the freeze is lifted. To place a fraud alert or credit freeze on your credit report, contact one of the the three major creditors below:

• Equifax: 800-525-6285

• Experian: 888-397-3742

• TransUnion: 800-680-7289

Data breach period: January 31, 2016- June 2, 2016

Official information from Noodles & Company: https://www.noodles.com/security/

Contact Noodles & Company: 888-849-1067

More coverage of this breach: Consumerist

LinkedIn, the professional social networking site, has announced that the 2012 breach that compromised 6.5 million login credentials is now much more extensive than they originally believed. The breached information is now known to include information on 167 million LinkedIn accounts, 117 million of which contain both the emails and the passwords of users. It is not clear whether the 167 million LinkedIn accounts include or are in addition to the original 6.5 million login credentials that were compromised by the same hack in 2012.

Announced: May 18, 2016

Description of breach: LinkedIn released a statement to its members on May 18, confirming the breach was larger than they originally believed and detailing the security procedures the website will undergo: “Yesterday, we became aware of an additional set of data that had just been released that claims to be email and hashed password combinations of more than 100 million LinkedIn members from that same theft in 2012. We are taking immediate steps to invalidate the passwords of the accounts impacted, and we will contact those members to reset their passwords. We have no indication that this is as a result of a new security breach.”

Data breach period: 2012

Official info from LinkedIn: https://blog.linkedin.com/2016/05/18/protecting-our-members

Contact LinkedIn: https://www.linkedin.com/help/linkedin/ask

More coverage of this breach: Fortune, Motherboard, and PCWorld

Orlando-based Rosen Hotels & Resorts has posted a data breach warning for customers who visited their hotels over an 18-month period. The chain joins Hyatt, Trump Hotels, Hilton Hotels, and Starwood Hotels as the latest hotel and resort chain falling victim to data breaches.

Announced: March 4, 2016

Description of breach: According to the company, hotel chain: “We received unconfirmed reports on February 3, 2016 of a pattern of unauthorized charges occurring on payment cards after they had been used by some of our guests during their stay. We immediately initiated an investigation into these reports and hired a leading cyber security firm to examine our payment card processing system. Findings from the investigation show that an unauthorized person installed malware in RH&R’s payment card network that searched for data read from the magnetic stripe of payment cards as it was routed through the affected systems. In some instances the malware identified payment card data that included cardholder name, card number, expiration date, and internal verification code.”

Data breach period: Cards used at RH&R between September 2, 2014 and February 18, 2016 may have been affected.

Official information from Rosen: https://www.rosenhotels.com/protectingourguests/

Contact Rosen: The hotel chain has established a helpline – (855) 907-3214 – for consumer questions about the incident. The call center is open from 8 a.m. to 8 p.m. EST, Monday to Friday.

List of Rosen Hotel properties

More coverage of this breach: Orlando Sentinel

The restaurant, casino, and entertainment company, which owns Landry’s Seafood, McCormick & Schmick’s, Morton’s, and Bubba Gump Shrimp restaurants, has received reports of unauthorized charges on credit cards of customers who had dined at its restaurants.

Announced: December 2015

Description of breach: Cyber attackers installed a program on payment processing devices at Landry’s locations that searched for data from the magnetic stripe of payment cards that had been swiped. Data that was obtained included cardholder name, card number, expiration date and the internal verification code. (More from Houston Business Journal.)

Affected customers: According to a statement from the company, locations were affected during three distinct periods in 2015: from May 4, 2014, through March 15, 2015, and/or from May 5, 2015, through Dec. 3, 2015. A small percent of Landry’s locations were also affected from March 16, 2015, through May 4, 2015.

Landry’s owns and operates more than 500 properties, including more than 40 different brands such as Landry’s Seafood, Chart House, Saltgrass Steak House, Bubba Gump Shrimp Co., Claim Jumper, Morton’s The Steakhouse, McCormick & Schmick’s, Mastro’s Restaurants and Rainforest Café.

Official information from Landry’s: https://www.landrysinc.com/pdf/pressReleases/2015/press_20151217.pdf

Contact Landry’s: Customers may call 877-238-2151 (U.S. and Canada), Monday through Friday from 9am to 7pm EST.

Help for victims: In a letter to customers, Landry’s offered the following advice: Landry’s advises  you  to  monitor  your  account  statements  for  unauthorized  charges.  You  should immediately contact the bank, credit union or other financial institution that issued your payment card if  you  see  any  unauthorized  charges. The  phone  number  to  call  is  usually  on  the  back  of  the  card. The  payment  card  companies  typically  guarantee  that  cardholders  will  not  be  responsible  for  unauthorized  charges that are timely reported. 

List of affected stores