Four Seasons Hotels and Resorts has announced that it was recently informed by a third-party hotel reservations provider that there has been unauthorized access to some of the hotel group’s guest information.
The reservations provider, Sabre, told the hotel group on June 6 that the information compromised was specifically from guests who had hotel reservations processed through Sabre’s SynXis Central Reservations System (CRS), from August 10, 2016 to March 9, 2017.
Sabre’s investigation revealed that a party gained access to account credentials that allowed unauthorized access to unencrypted payment card information, as well as a certain reservation system. The unauthorized party first obtained access to the payment card and reservation information on August 10, 2016, with the last access date being March 09, 2017.
Search and compare product listings for Cyber Insurance from specialty market providers here
The investigation did not uncover any evidence that the unauthorized party removed any information from the system, but the possibility has not been completely ruled out.
According to Four Seasons, Sabre has confirmed that the issue has been contained and the unauthorized access has been revoked. The reservations provider warned, however, that some guest information may have been compromised as a result of the incident.
The hotel group offered reassurance that customers who had reserved directly with any of its 105 hotels or resorts, through its website, or through the Four Seasons Worldwide Reservations Office, were not compromised by the incident.
Sabre is currently collaborating with a cybersecurity firm to support its investigation, and has notified law enforcement and major credit card companies of the incident.
