08/15/2016
Credit Card Terminal Data Breach Affects Leading Hospitality Companies
Source:
Connecticut Restaurant Association
38 Hungerford St.
Hartford, CT 06106
P: (860) 278-8008
CT Restaurant Association article, August 12, 2016
8/10/16
Oracle, the renowned computer software developer, recently confirmed to cybersecurity experts that its customer support portal, MICROS, has suffered a massive data breach. The MICROS terminal, which handles credit card payments at approximately 330,000 cash registers worldwide, is used in restaurants and hotels globally, including some of the largest chains in the hospitality industry. It is reported that the malicious code could allow hackers to log into the point of service (POS) terminal in the same way as Oracle would in order to provide customer support.
Oracle has stated that all payment card data is encrypted, thus mitigating the actual risk of hackers using the data. At this time, however, the extent of the damage is not entirely clear, and Oracle has already begun notifying customers, urging them to change the MICROS passwords for all accounts. Oracle purchased MICROS, a leading POS vendor, in 2014.
This breach serves as a prime example of how interconnected corporate systems are with business partners, Cloud vendors, and other third parties. It emphasizes that businesses are only as secure as the weakest link within their digital ecosystem.
This incident also demonstrates the importance of using encryption as an added control to protect critical data against malicious access when other preventative controls failed.
Businesses should evaluate their cybersecurity capabilities and the controls in place to prevent, detect, and recover from a cyber-related event. The best way to do this is to perform a cyber risk assessment, combined with a technical evaluation of their vulnerabilities. Companies should also have a documented incident response plan in place and evaluate the plan through a breach response exercise.
