HEI Hotels & Resorts, which operates hotels for Starwood (HOT), Marriott (MAR) and Hilton (H) among others, has warned customers that their payment card data may have been stolen over the last couple years.
The company said criminals had managed to install malware on the payment processing systems in 20 of its hotels. The malicious software could have been used to siphon off customers’ names, card numbers, expiry dates and verification codes, HEI said.
“We have disabled the malware and are in the process of re configuring various components of our network and payment systems to enhance the security of these systems,” the firm said.
Get Data Sheet, Fortune’s technology newsletter.
“We have contacted law enforcement and will continue to cooperate with their investigation. We are also coordinating with the banks and payment card companies.”
HEI’s card processor alerted the company to the problem. The firm said it had since moved its payment card processing to a “stand-alone system that is completely separated from the rest of our network,” and making payments at the hotels was now safe.
Nonetheless, it recommended that customers review their credit and debit card account statements and report any suspicious activity to the cards’ issuers.
For more on cybersecurity, watch our video.
These are the hotels whose systems were infected, and the dates on which details may have been stolen:
- Boca Raton Marriott at Boca Center (3/1/2015 – 6/7/2015 and 12/15/2015 – 4/11/2016)
- Dallas Fort Worth Marriott Hotel & Golf Club (12/26/2015 – 4/28/2016)
- Equinox Resort Golf Resort & Spa (12/23/2015 – 5/4/2016)
- Hotel Chicago Downtown (12/26/2015 – 4/27/2016)
- Hyatt Centric Santa Barbara (12/26/2015 – 6/21/2016)
- Intercontinental Tampa Bay (3/21/2015 – 6/21/2016)
- Le Meridien Arlington (12/23/2015 – 4/28/2016)
- Le Meridien San Francisco (3/1/2015 – 6/7/2015 and 12/2/2015 – 6/8/2016)
- Renaissance San Diego Downtown Hotel (12/26/2015 – 5/2/2016)
- Royal Palm South Beach Miami (12/23/2015 – 6/6/2016)
- San Diego Marriott La Jolla (12/26/2015 – 5/2/2016)
- Sheraton Music City Hotel (3/1/2015 – 5/2/2016)
- Sheraton Pentagon City (3/3/2015 – 6/7/2015 and 12/2/2015 – 6/13/2016)
- The Hotel Minneapolis Autograph Collection (3/1/2015 – 4/27/2016)
- The Westin Minneapolis (9/2/2015 – 6/17/2016)
- The Westin Pasadena (3/3/2015 – 5/18/2016)
- The Westin Philadelphia (3/10/2016 – 6/6/2016)
- The Westin Snowmass Resort (12/26/2015 – 4/10/2016)
- The Westin Washington, D.C. City Center (11/15/2015 – 5/28/2016)
- Westin Fort Lauderdale (1/29/2016 – 4/13/2016)