Accommodation
and Food Services

Resumen

Point of Sale related attacks no longer dominate breaches in Accommodation and Food Services. Instead, responsibility is spread relatively evenly among several attack types including malware, error and hacking via stolen credentials. Financially motivated attackers continue to target this industry for the payment card data it holds.

Frecuencia

125 incidents, 92 with confirmed data disclosure

Top Patterns

Crimeware, Web applications, and Point of Sale represent 61% of data breaches

Threat Actors

External (79%), Internal (22%), Multiple (2%), Partner (1%) (breaches)

Actor Motives

Financial (98%), Secondary (2%) (breaches)

Data compromised

Payment (68%), Personal (44%), Credentials (14%), Other (10%) (breaches)

Top Controls

Limitation and Control of Network Ports, Protocols, and Services (CSC 9), Boundary Defense (CSC 12), Data Protection (CSC 13)

Breaches Served with a Smile

The Accommodation and Food Services industry is one that we have been tracking for quite a while. There’s just something welcoming about it that keeps us coming back. One lesson that we learned from all our time spent here is that malware plays a relatively large role in this industry.  Crimeware and Point of Sale (both malware dependent) represent two of the top three patterns this year. These are joined by this year’s darling of Web applications attacks, which covers both the Use of stolen credentials and the Exploitation of vulnerabilities, as seen in Figure 53.