Attacks/Breaches

11/30/2018
12:00 PM
50%
50%

Massive Starwood Hotels Breach Hits 500 Million Guests

Among the unknowns: who is behind the breach and how many of the affected records have been sold or used by criminals.

This is a developing story. Please check Dark Reading for updates.

More than 500 million guests of Starwood Hotels had their personal information exposed in a breach that stretched from 2014 until this past September. Starwood parent Marriott International disclosed the breach Thursday with an announcement that provided some details but left many questions unanswered.

"For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ("SPG") account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences," Marriott noted.

The company also said that for an undisclosed number of guests, the accessed information includes payment card numbers and expiration dates, though that information was protected by AES-128 encryption. That comforting detail was tempered somewhat by the company's admission that it cannot rule out the possibility that both keys necessary for decryption were also taken in the breach.

Among the information not disclosed or unknown is precisely who is behind the breach and how many of the affected records have been sold or used by criminals.

Marriott announced the purchase of Starwood in November 2015, with the deal closing in September 2016, some two years after the breach began. While Marriott International's stock took a hit on yesterday's announcement, falling around 7% from Wednesday's close, it did not see a substantial, immediate loss. Of course, the breach disclosure came far too late to have an effect on how much Marriott was paying for Starwood, unlike the impact of a massive security breach on the sale price of Yahoo when it sold its Internet business in 2017. 

"This is yet another example of why it is critical that companies perform cyber due diligence prior to an acquisition or investment," says Jake Olcott, vice president of communications and government affairs at BitSight. "Understanding the cybersecurity posture of an investment is critical to assessing the value of the investment and considering reputational, financial, and legal harm that could befall the company."

The amount and nature of the data taken in the breach could have an impact far beyond the financial information sold on the Dark Web. "The personal data obtained in one breach could be cross-referenced with data obtained from another breach and other widely publicized private sector breaches, and the Marriott breach only makes their task that much easier and more likely to succeed," says Michael Magrath, director of global regulations and standards at OneSpan.

And that cross-referencing could have implications beyond the business realm. "This is much more than a consumer data breach. When you think of this from an intelligence-gathering standpoint, it is illuminating the patterns of life of global political and business leaders, including who they traveled with when and where," says Michael Daly, CTO, cybersecurity and special missions, at Raytheon Intelligence, Information & Services. "That is incredibly efficient reconnaissance-gathering and elevates this breach to a national security problem."

While Marriott says it has reported the breach to law enforcement agencies and is cooperating with their investigations, legal fallout seems likely around the world. Class-action lawsuits are almost certain in the US, and many in the international business community will be watching the EU as regulators begin their investigations into what may be the first large test of the penalties possible under GDPR.

Email notifications have begun for affected customers, Marriott says. In addition, the company has set up an informational website and is offering guests free enrollment in WebWatcher for one year.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JimDD
50%
50%
JimDD,
User Rank: Author
11/30/2018 | 12:50:54 PM
That many?
The thing that I find so amazing is not that there was a big breach but that approximately 12.5% of the world's population stayed at a Starwood between 2014 and 2018. 
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...