Las Vegas' Hard Rock Hotel & Casino announced their second breach in about a year.The culprit: Card-scraping malware on its point-of-sale system from Oct. 27, 2015 to March 21, 2016.
The data break-in provided hackers with access to payment card data, including name, card number, expiration date, and verification code. In a few instances, the malware only obtained the card data without the customer's name.
Hard Rock uncovered the breach after receiving reports of fraudulent activity. Investigators then discovered the malware and unauthorized POS network access.
The company faced a similar breach in May 2015 when the hotel announced that hackers accessed customer names, credit card numbers, expiration dates and CVV codes for credit and debit card transactions conducted between Sep. 3, 2014 and April 2, 2015 at the restaurant, bar and retail locations on the Hard Rock Hotel's Las Vegas property.
The hotel did not provide an estimate of the possible number of victims. "It is always advisable to remain vigilant to the possibility of fraud by reviewing your payment card statements for any unauthorized activity," the company said in its statement.
Experts weighed in on some of the lessons learned from these breaches and the threats they present.
Join us at the new Credit Union Times Fraud: Don't Let It Happen To Your Credit Union Conference, where you will find the latest tools and techniques for preventing fraud and data breaches; strategies for responding in the immediate aftermath and best practices for restoring reputation, financial stability and information security . This two-day conference is designed for credit union executives, board of directors and those responsible for your credit unions cyber security policy. Register to attend and save $150.
"Hospitality organizations are ideal targets for the cybercriminal today because they handle highly valuable personal and financial information, the proverbial goldmine for the cyberthief. Large, well-known chains are even more susceptible targets due to the sheer volume of data that they store and share," Zach Forsyth, a director of technology innovation at Clifton, N.J.-based cybersecurity firm Comodo, said. "It is a harsh reality that the technology some organizations use today is as effective as installing a home security system that alerts you to a break-in after the robbers have already stolen everything, vandalized the house and left. By then, it's too late."
Forsyth added the focus for all IT departments needs to be on protection, not detection, and installing modern secure web gateways and advanced endpoint protection solutions that can stop malware and cyberattacks.
"Customers like this need to understand that they are in a digital war with the hackers that want this type of data. The entire industry, regardless of vertical specialty, needs to wake up and realize that traditional cybersecurity defenses are no longer working," John Christly, CISO at Fort Lauderdale, Fla.-based cybersecurity company Netsurion, remarked. "New defensive approaches, advanced cybersecurity tools and increased cyberintelligence need to be deployed.There is no silver bullet strategy to defend against every threat. However, a strong line of defense is making sure that data doesn't leave the network without the admin's knowledge and if data is sent out, it only goes to verified Internet addresses."
Keeping POS system security up-to-date is nearly impossible, which is probably the reason for the high number of attacks, Joe Dahlquist, senior director of product management at Carlsbad, Calif.-based ThreatSTOP, pointed out. "It requires vigilance in both ensuring the security team is aware of the latest threats, then locking down the POS device security policies with the latest threat data."
Dahlquist noted another way to look at POS security is to block all network communications, both inbound attacks and outbound data exfiltration that use IP addresses known to have been involved in launching such attacks.
"The Hard Rock Hotel & Casino hasn't disclosed how many customers have been impacted by the latest breach event. Odds are early detection and containment would've meant that contacting a small number of compromised accountholders would've been far easier than having to disclose a significant event to a greater number of customers," J. Paul Haynes, CEO of Cambridge, Ontario, Canada-based eSentire, said. Haynes added credit card and user information has a long shelf life on the black market.
Join us at the new Credit Union Times Fraud: Don't Let It Happen To Your Credit Union Conference, where you will find the latest tools and techniques for preventing fraud and data breaches; strategies for responding in the immediate aftermath and best practices for restoring reputation, financial stability and information security . This two-day conference is designed for credit union executives, board of directors and those responsible for your credit unions cyber security policy. Register to attend and save $150.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.