Nancy Trejos, USA TODAY
White Lodging, a company that manages hotels for nationwide brands such as Marriott, Holiday Inn and Sheraton, is investigating a possible data breach at 14 properties.
The suspected credit and debit card breach occurred between March 20 and Dec. 16 at restaurants, lounges and other food and beverage outlets at those properties, the company said in a statement this afternoon.
The hotels, which White Lodging manages under agreements with the owners, are located in various cities, including Chicago, Austin, Denver and Indianapolis. White Lodging runs as a separate entity from the hotel brands.
Guests who didn't use their credit cards at the outlets or who charged items directly to their room accounts were not affected, the company said.
At one hotel, the Radisson Star Plaza in Merrillville, Ind., the breach could have gone beyond food and beverage outlets and into the property management system that manages guests' credit card information.
White Lodging, which is based in Merrillville and manages 169 hotels, says it immediately contacted federal law enforcement officials and initiated a review of all its other properties. It also contacted the financial institutions that issue the credit and debit cards. Those institutions are increasing their fraud monitoring or reissuing cards, the company said.
"We continue to work with investigators and the credit card companies," the company said in its statement.
The U.S. Secret Service said it is investigating the matter.
The company said that the information that was compromised could have included names printed on credit or debit cards, the actual numbers, the security codes and expiration dates.
"Guests who used or visited the affected businesses during the nine month-period and who used a credit or debit card to pay their bills at the outlets might have had such information compromised and are encouraged to review their statements from that time period," the company said.
Visa, MasterCard, American Express and Discover do not hold customers liable for unauthorized charges if they report them in a timely manner.
White Lodging will offer affected customers one year of complimentary identity protection services.
Marriott, which had nine properties affected, including two under its Renaissance brand, said in a written statement that it was working closely with White Lodging as they investigate the breach.
"Since this impacts customers of Marriott properties, we want to provide assurance that Marriott has a long-standing commitment to protect the privacy of the personal information that our guests entrust to us, and we will continue to monitor the situation closely," the company said.
"As you can imagine, the privacy and security of our guest information is very important to Starwood, and we are working closely with White Lodging as they conduct their investigation," Starwood Hotels and Resorts, parent company of Westin and Sheraton, said in a statement. "The breach appears to have affected food and beverage outlets at the hotels and to our knowledge, the system that manages hotel guests' credit card information was not affected at either of our properties."
InterContinental Hotels Group, parent company of Holiday Inn, which had two properties affected, said it too was cooperating with White Lodging.
"IHG is committed to protecting the privacy and personal information of our guests," the company said. "IHG is in communication with White Lodging, who continues to provide updates on the investigation to their business partners, as well as to consumers via their website."
This latest incident comes as a number of major retailers have had to deal with their own security attacks.
Millions of people who shopped at Target Nov. 27 through Dec. 15 could have had their credit and debit information and other personal data compromised.
The affected hotels in the White Lodging incident are:
- Marriott Midway, Chicago
- Holiday Inn Midway, Chicago
- Holiday Inn Austin Northwest, Austin
- Sheraton Erie Bayfront, Erie, Pa.
- Westin Austin at the Domain, Austin
- Marriott Boulder, Boulder
- Marriott Denver South, Denver
- Marriott Austin South, Austin
- Marriott Indianapolis Downtown, Indianapolis
- Marriott Richmond Downtown, Richmond, Va.
- Marriott Louisville Downtown, Louisville, Ky.
- Renaissance Plantation, Plantation, Fla.
- Renaissance Broomfield Flatiron, Broomfield, Colo.
- Radisson Star Plaza, Merrillville, Ind.