Customers at risk after laptop theft

SEATTLE – About 243,000 Hotels.com customers may be at risk for identity theft after a password-protected laptop computer containing their credit card information was stolen from an Ernst & Young auditor, a company spokesman said Saturday.

The laptop was taken in late February from a locked car in what police have said appears to be a “random petty theft,” said Paul Kranhold, spokesman for Hotels.com, a subsidiary of Expedia.com, which is based in the Seattle suburb of Bellevue, Wash.

“As a result of our ongoing communication with law enforcement, we don’t have any indication that any credit card numbers have been used for fraudulent activity,” Kranhold said. “It appears the laptop was not the target of the break-in.”

Ernst & Young, which has been the outside auditor for Hotels.com for several years, notified Hotels.com of the security breach on May 3. The company “has been spending the last couple weeks figuring out exactly who these people were and the best means of communicating with them,” Kranhold said.

Both Hotels.com and Ernst & Young mailed letters to Hotels.com customers this past week encouraging them to take appropriate action to protect their personal information.

The transactions recorded on the laptop were mostly from 2004, although some were from 2003 or 2002, the companies said. The computer contained personal information including names, addresses and credit card information of Hotels.com customers.

The letter from Ernst & Young took full responsibility for the incident.

“We deeply regret this incident has occurred and want to apologize to you and Ho-tels.com for any inconvenience or concern this may cause,” said the unsigned memo from Ernst & Young dated May 2006.

Ernst & Young offered a toll-free number to call for further information and invites those affected by the incident to enroll in a free credit monitoring service arranged by Ernst & Young.

Hotels.com also apologized in its letter.

“We sincerely regret that this incident occurred and we are taking it very seriously,” said the letter signed by general manager Sean Kell.

The letter from Hotels.com said, “Ernst & Young was taking additional steps to protect the confidentiality of its data, including encrypting the sensitive information we provide to them as part of the audit process.”