Ten months of credit card information and personal details for guests at a West Kelowna hotel may have been accessed by hackers, after a worker there fell for a phishing email.
The Best Western Plus Wine Country Hotel & Suites informed recent guests of the breach in an email Tuesday, saying that "an unknown person" had gained access to the hotel's front desk system.
The phishing scam allowed that person into the system between Sept. 17, 2016 and July 20 of this year.
"At this time, we have no knowledge that your personal information has, in fact, been accessed or misused by the unauthorized party. Nonetheless, as you were recently a guest at the Best Western Plus, we wanted to notify you," the email reads.
The hotel's front desk system collects guests' names, addresses, phone numbers and emails, as well as credit card numbers, expiration dates, magnetic stripe information and CCV/CVC numbers.
At least a dozen cards compromised
According to the email, "the incident has been contained," and the hackers no longer have access to the system. The hotel says it has brought in new security measures and reported the breach to police and provincial privacy commissioners.
"The relevant credit card companies have been notified, and they have cancelled any potentially affected credit cards and reissued new cards," the email reads.
According to Cpl. Tania Carroll of the Kelowna RCMP, an investigation was opened in November, at which time police determined that about a dozen credit cards had been compromised.
It's not clear if that investigation continued through July, when the hotel says the hackers were cut off, and Carroll has yet to respond to follow-up questions.
The hotel recommends that guests who are concerned about the safety of their information should keep an eye on their bank and credit card statements and report any suspicious activity.
Best Western responds
In an emailed statement, Best Western International spokesperson Courtney McCurry said its hotels are independently owned and operated, but each one "vigilantly protect[s] consumer data."
"It is Best Western's understanding that the hotel was the victim of cyber criminals. The hotel has advised Best Western that it has completed a thorough investigation, remediated the matter and is complying with legal notification requirements regarding the matter," McCurry said.
The owners of the West Kelowna hotel have yet to respond to requests for comment.