Hotels & Lodging · Hotel operator · Data breach
Omni Hotels & Resorts
Headline
Omni's 2016 point-of-sale malware incident is the kind of breach that best illustrates why hotels are a distinct risk category: the compromise sat on point-of-sale systems at some of its properties…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Omni's 2016 point-of-sale malware incident is the kind of breach that best illustrates why hotels are a distinct risk category: the compromise sat on point-of-sale systems at some of its properties (the disclosure did not itemise which outlets), and a POS compromise of that kind can capture card data from restaurant, bar, spa and gift shop transactions as well as room charges. A hotel is not one merchant, it is a dozen merchants under one roof sharing a payment environment, and a guest swiping at the poolside bar is transacting inside the same system that holds their room folio.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not confirmed this pass.
Data sharing
Select Guest loyalty programme ties stay and on-property spend to a member profile. In July 2016 Omni disclosed a malware intrusion at point-of-sale systems at some of its properties, exposing payment card data between Dec 23, 2015 and June 14, 2016 (Dark Reading, July 12, 2016). In late March 2024 a cyberattack forced Omni to take systems offline; Omni said limited information about a subset of customers (names, email and mailing addresses, Select Guest loyalty information; not payment card or Social Security data) may have been affected, and the Daixin ransomware group claimed to hold data on 3.5 million guests (an unverified attacker claim) (Help Net Security, Apr 2024).
Fees and billing
Resort fees at destination properties.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.omnihotels.com/privacy-policy | Not fetched yet | N |
| Terms of service https://www.omnihotels.com/terms-and-conditions | Not fetched yet | N |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.