Drury Hotels Announces Third Party Service Provider Security Incident
Drury Hotels has taken measures to address a security incident experienced by a third party technology service provider. The service provider, a company that Drury Hotels (and other hotel companies) uses to collect reservations made by guests on third party online booking websites and enter them into its system, notified Drury that it was investigating unauthorized access to the service provider's network. The service provider later advised us that certain transaction records from some third party online booking sites were accessed during the incident from December 29, 2017 to March 13, 2019. Reservations that were made directly with Drury Hotels (by calling Drury Hotels or using our website or mobile app) were not involved in this incident.
What Happened?
For most hotels, there are two ways to make a reservation – directly with the hotel or indirectly through third party online booking websites (websites run by other companies that compare rooms and rates at different hotels). For reservations that are made through online booking websites, many hotels use a technology service provider to collect the reservation data from the online booking company and enter it into the hotel's property management system. On March 26, 2019, we were notified by the company that provides that service to us and other hotel companies that it was conducting an investigation to determine if there had been unauthorized access to its network. The service provider reported that it had hired a cybersecurity firm to conduct an investigation.
What Information Was Involved?
The information in the transaction records that were involved included name, payment card number, expiration date, and the card's external verification code. Some transaction records also included mailing addresses or email addresses. Specific details regarding the reservation itself were not involved. Only transaction records from some third party online booking websites were involved. And only some, not all, of the transaction records from those third party online booking sites were involved.
What You Can Do.
We encourage you to closely review your payment card statements for any unauthorized charges. You should immediately report any such charges to the bank that issued your card. If reported timely, payment card network rules generally provide that cardholders are not responsible for unauthorized charges. Information about this incident and additional steps you can take can be found on the dedicated website Drury Hotels established regarding this incident - https://ide.myidcare.com/druryhotels.
What We Are Doing.
We regret that this incident occurred and apologize for any inconvenience. Since then Drury Hotels has worked closely with the service provider to get updates on its investigation. We received a list of the specific transaction records that were involved on May 15, 2019. For the transaction records that contained a mailing address, Drury Hotels is mailing letters to those individuals. For transaction records without an address that contained an email address, Drury Hotels is sending email notifications to those individuals. And Drury Hotels issued this press release and posted a notification on its website to provide notification to others involved. If you do not receive a notification letter or email, either your information was not involved in this incident or the list from the service provider did not contain your mailing address or email address.
Drury Hotels received confirmation from the service provider that it has undertaken measures to prevent something like this from happening again. We will continue to work with the service provider to identify the security enhancements it is implementing.