Provision in respect of cyber attack and contingent liability, risks and uncertainties

InterContinental Hotels Group PLC – Annual report – 31 December 2016

Industry: leisure

  1. Provisions

ihg1

The amount provided in the year in respect of the Kimpton Security Incident has been recognised within Central costs in the Group income statement.

Litigation largely relates to actions brought against the Group in The Americas region. In relation to the $12m settled during the year, an insurance recovery of $8m was also recorded by the System Fund.

  1. Contingencies and guarantees (extract)

Security incidents

During the first half of 2016, the Group was notified of a security incident at a number of Kimpton hotels that resulted in unauthorised access to guest payment card data (the Kimpton Security Incident). Based on the estimated number of cards affected and opinion of external advisers, an amount of $5m has been provided in the Financial Statements (see note 19) to cover the estimated cost of reimbursing the impacted payment card networks for counterfeit fraud losses and related expenses. This estimate involves significant judgement based on currently available information and is subject to change as actual claims are made and new information becomes available.

In December 2016, the Group was notified of a security incident at a number of hotels in The Americas region (the Americas Security Incident). The Group issued a Substitute Notice on 3 February 2017 notifying guests that malware was installed on servers that processed payment cards used at restaurants and bars of 12 IHG managed properties. An investigation of other properties in The Americas region is ongoing. It is not practicable to make a reliable estimate of the possible financial effect of any claims concerning the Americas Security Incident at this time.

The Group may be exposed to investigations regarding compliance with applicable State and Federal data security standards, although no claims have been received to date. In addition, the Group is exposed to legal action from individuals and organisations impacted by the security incidents. A class action has been filed in the courts in relation to the Kimpton Security Incident, although alleged damages have not been specified. It is not practicable to make a reliable estimate of the possible financial effect of any claims on the Group at this time.

In respect of the $5m provided in the Financial Statements, it is expected that a proportion will be recoverable under the Group’s insurance programmes although this, together with any potential recoveries in respect of the contingent liabilities detailed above, will be subject to specific agreement with the relevant insurance providers.

Risk management (extract)

ihg2

IHG3