Atlantis, Paradise Island provides notice of “data security incident”

Atlantis, Paradise Island today announced that a recent data security incident may have compromised the security of payment information of some customers who used debit or credit cards at food and beverage and retail locations at the Resort between November 1, 2016 and April 3, 2017. We have engaged professionals who have corrected the issue and customers can now safely use their credit and debit cards at the food and beverage and retail locations at the Resort. This incident did not affect credit and debit cards used to make or pay for hotel reservations or purchases made by guests who charged their food and beverage or retail purchases back to their room.

What Happened?

The Resort began investigating unusual activity after receiving reports from its credit card processor. The Resort immediately began working with third-party forensic experts to investigate these reports and to identify any signs of compromise on its computer systems. On May 10, 2017, the Resort confirmed the existence of suspicious files on its computer systems that indicated a potential compromise of customers’ credit and debit card data for some credit and debit cards used at food and beverage and retail locations at the resort.

The Resort has been working with third-party forensic investigators to determine what happened and what information was affected. The Resort has confirmed that malware may have captured data from some credit and debit cards used at food and beverage and retail locations at the Resort. The Resort has removed the malware at issue to contain this incident and implemented additional procedures in an effort to prevent any further unauthorized access to customers’ credit and debit card information. This incident did not affect credit and debit cards used to make or pay for hotel reservations or purchases made by guests who charged their food and beverage or retail purchases back to their room.

What Information Was Involved?

Through the ongoing third-party forensic investigations, the Resort confirmed that malware may have captured credit and debit card data from some credit and debit cards used at food and beverage and retail locations between November 1, 2016 and April 3, 2017. The information at risk as a result of this event for credit or debit cards used at the impacted locations includes the card number, expiration date and CVV. This incident did not involve customers’ Social Security numbers as this information is never collected by the Resort. This incident did not involve customers’ names or PIN numbers, either.

What We Are Doing.

“The Resort takes the security of our customers’ information extremely seriously, and we apologize for the inconvenience this incident may have caused our customers,” Howard C. Karawan, President and Managing Director of Atlantis, Paradise Island, stated. Mr. Karawan expanded, “We continue to work with third-party forensic investigators to ensure the security of our systems on behalf of our customers and would like to take this opportunity to remind customers to remain vigilant against fraud by reviewing their financial account statements regularly and reporting any suspicious activity.”

What You Can Do.

The Resort encourages all customers to remain vigilant against identity theft by reviewing their financial account statements regularly and monitoring their credit reports for suspicious activity. Customers should immediately report any unauthorized charges to their card issuer. The phone number to call is usually on the back of the credit or debit card. Under U.S. law, individuals over the age of 18 are entitled to one free credit report annually from each of the three major credit bureaus.

The Resort encourages customers who believe they may be affected by this incident to take additional action to further protect against possible identity theft or other financial loss. At no charge, customers can have these credit bureaus place a “fraud alert” on their file, alerting creditors to take additional steps to verify their identity prior to granting credit in their name. Note, however, that because it tells creditors to follow certain procedures to protect the customer, a fraud alert may also delay customers’ ability to obtain credit while the agency verifies their identity. As soon as one credit bureau confirms a customer’s fraud alert, the others are notified to place fraud alerts on the customer’s file.

Customers may also place a security freeze on their credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a customer’s credit report without the consumer’s written authorization. However, customers should be aware that placing a security freeze on their credit reports may delay, interfere with or prevent the timely approval of any requests they make for new loans, credit mortgages, employment, housing, or other services. If a customer has been a victim of identity theft and provides a credit reporting agency with a valid police report, the agency cannot charge the customer to place, lift or remove a security freeze. In all other cases, a credit reporting agency may charge a fee to place, temporarily lift or permanently remove a security freeze. Customers will need to place security freezes separately with each of the three major credit bureaus listed above if they wish to place a freeze on all of their credit files.