For The First Time, FTC Hits Hard Against Chain Breached Three Times

For almost as many years as it has existed, the Federal Trade Commission has complained about being toothless when it comes to punishing retailers and other businesses. But the FTC on Tuesday (June 26) said it has found its breaking point, when one hotel chain was breached three times—all leveraging the same unpatched security holes, more than a year apart—to the tune of some 619,000 payment cards and more than $10.6 million in fraud loss. This time—for the first time—the agency is going to trial.

The chain, Wyndham Hotels, is also accused of other supremely naughty security procedures, including storing full payment-card data in clear text, not having proper network segmentation and deploying classically bad password policies. "For example, to allow remote access to a hotel's property management system, which was developed by software developer Micros Systems Inc., Defendants used 'micros' as both the user ID and the password," said the FTC's federal filing.

Lisa Schifferle, an attorney in the FTC's division of privacy and identity protection, said the egregious nature of Wyndham's actions—and particularly that it was breached and failed to fix the holes after 11 months, was breached again and again failed to fix the holes, and was then breached a third time some six months later—finally pushed the agency to take action.

"This is the first data security case that we'll be litigating," Schifferle said.

As a practical matter, it's unclear how much litigating will happen, and settlements in such cases are common. But if the government opts to stand firm and to try and make an example of a chain the FTC says was recklessly handling payment-card data, it appears it picked an ideal case.

As is often with federal legal action, the core of the case is not the worst alleged behavior but the behavior closest to violating existing law. It's not illegal in the U.S. to handle payment-card data recklessly. But misrepresentations in ads, that there is a statue for.

Hence, the feds are nailing Wyndham because of wording on its Web site. "Since 2008 Wyndham has claimed, on its Wyndham Hotels and Resorts subsidiary’s Web site that, 'We recognize the importance of protecting the privacy of individual-specific (personally identifiable) information collected about guests, callers to our central reservation centers, visitors to our Web sites, and members participating in our Loyalty Program.'" If the FTC can prove that statement to be false, the agency has got Wyndham on fraud.

The cases involve data being siphoned off hotel servers and sent to what the government said was a domain registered in Russia. The attacks all focused on the chain's Phoenix datacenter.

The government said one key factor was insufficient firewall protections. "As far as we know, there were no firewalls that protected the data," Schifferle said.

The clear-text accusation was a bit murky, in the sense that the government said it was due to the chain's software being "configured inappropriately, resulting in the storage of payment-card information in clear readable text." Given different references in the filing, it's not clear if Wyndham IT employees configured the software poorly or whether the cyberthieves accessed the software and made those changes—or both.

Other allegations include examples of even sloppier IT procedures:

  • One major system at the chain "was using an operating system that its vendor had stopped supporting, including providing security updates and patch distribution, more than three years prior to the intrusion. Defendants were aware the hotel was using this unsupported and insecure server, yet continued to allow it to connect to Hotels and Resorts’ computer network."
  • "Well-known default user IDs and passwords were enabled on the servers, which were easily available to hackers through simple Internet searches."
  • "Failed to follow proper incident response procedures, including failing to monitor Hotels and Resorts’ computer network for malware used in a previous intrusion; and failed to adequately restrict third-party vendors’ access to Hotels and Resorts’ network and the Wyndham-branded hotels’ property management systems, such as by restricting connections to specified IP addresses or granting temporary, limited access, as necessary."
  • The filing described a brute force attack that caused 212 user accounts to be locked out due to excessive password guesses. The lockouts "are a well-known warning sign that a computer network is being attacked. Defendants did not have an adequate inventory of the Wyndham-branded hotels’ computers connected to its network, and, therefore, although they were able to determine that the account lockouts were coming from two computers on Hotels and Resorts’ network, they were unable to physically locate those computers. As a result, Defendants did not determine that the Hotels and Resorts’ network had been compromised until almost four months later."
  • "The intruders’ brute force attack led to the compromise of an administrator account on the Hotels and Resorts' network. Because Defendants did not appropriately limit access between and among the Wyndham-branded hotels' property management systems, the Hotels and Resorts' own corporate network, and the Internet—such as through the use of firewalls—once the intruders had access to the administrator account, they were able to gain unfettered access to the property management system servers of a number of hotels."
  • "In May 2009, Defendants learned that several Wyndham-branded hotels had received complaints from consumers about fraudulent charges made to their payment-card accounts after using those cards to pay for stays at Wyndham-branded hotels. At that point, Defendants searched Hotels and Resorts' network for the memory-scraping malware used in the previous attack, and found it on the property management system servers of more than 30 Wyndham-branded hotels. As a result of Defendants' failure to monitor Hotels and Resorts' network for the malware used in the previous attack, hackers had unauthorized access to the Hotels and Resorts' network for approximately two months."
  • This is the reference that suggests it was the attackers who made the system store files in clear text: "In addition to again using memory-scraping malware to access personal information, in this second breach, the intruders reconfigured software at the Wyndham-branded hotels to cause their property management systems to create clear-text files containing the payment-card account numbers of guests using their payment cards at the hotels."