The Marriott statement said for around 326 million of its guests, the personal information compromised included “some combination” of, name, address, phone number, email address, passport number, date of birth, gender and arrival & departure information. The hotelier also said encrypted payment card data was also copied, and it could not rule out the encryption keys to decrypt cardholder data had not been stolen.
The hotel giant said it would notify customers affected and offer some a fraud detecting service for ayear for free, so I expect they will be making contact with myself soon. In the meantime, Marriott has launched a website for affected customers .
The UK ICO said it would be investigating the breach , and warned those whobelieve they are impacted to be extra vigilant and to follow the advice on the ICO website, and by the National Cyber Security Centre . The hotel chain could face huge fines under the GDPR, and possibly a large scale class action lawsuit by their affected guests, which could cost them millions of pounds.
What I really would like to know is why the hotel chain had retained such vast numbers of guest records post their stay. Why they held their customer’s passport details and whether those encryption keys were stolen or not. And finally, why the unauthorised access went undetected for four years.
Tom Kellermann, Chief Cybersecurity Officer for Carbon Black , said “It appears there had been unauthorised access to the Starwood network since 2014, demonstrating that attackers will get into an enterprise and attempt to remain undetected. A recent Carbon Black threat report foundThe report also found that more than a third (36%) of today’s attackers now use the victim primarily for island hopping. In these campaigns, attackers first target an organisation’s affiliates, often smaller companies with immature security postures and this can often be the case during an M&A. This means that data at every point in the supply chain may be at risk, from customers, to partners and potential acquisitions.”
Jake Olcott, VP of Strategic Partnerships at BitSight, said “Following the breaking news today that Marriott’s Starwood bookings database has been comprised with half a billion people affected, it highlights the importance of organisations undertaking sufficient security posture checks to avoid such compromises. Marriott’s acquisition of Starwood in 2016 allowed it to utilise its Starwood customer database. Therefore, proactive due diligence during this acquisition period would have helped Marriott to identify the potential cybersecurity risks, and the impact of a potential breach”.
“This is yet another example of why it is critical that companies perform cybersecurity analysts during the due diligence period, prior to an acquisition or investment. Traditionally, companies have approached cyber risk in acquisitions by issuing questionnaires to the target company; unfortunately, these methods are time consuming and reflect only a “snapshot in time” view.
“Understanding the cybersecurity posture of an investment is critical to assessing the value of the investment and considering reputational, financial, and legal harm that could befall the company. After an investment has been made, continuous monitoring is essential.”