Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/4/2019
05:00 PM
50%
50%

Marriott Sheds New Light on Massive Breach

New information on the Starwood breach shows that the overall breach was somewhat smaller than originally announced, but the news for passport holders is worse.

Commenting on a new round of information about the massive data breach that struck Starwood Hotels, Marriott International now says that the breach was somewhat less massive than originally thought, affecting roughly 383 million records rather than the 500 million originally said to have been compromised.

The news about the passport information released is not as good: Marriott has now put a number on the breached passport records, and it's 5.25 million. That's the number of unencrypted passport numbers that were accessed; roughly 20.3 million encrypted numbers were grabbed by the perpetrators, though Marriott says that there is no evidence that the criminals got the key required for unencrypting the files.

Responding to the announcement, Matt Aldridge, senior solutions architect at Webroot, said, "A key question we need to ask is why do hotels need to store passport numbers? One of the biggest impacts of GDPR was that it forced companies to consider the personal data they hold and ask customers for, whether this data was really needed and if so how to properly protect it. This is a great example of too much data being collected and retained."

Marriott says that it will have a mechanism available on its website for guests to check in order to see whether their passport number was accessed; the company promises to update the website and notify the public when the mechanism is running.

For more, read here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Pm4zv
50%
50%
Pm4zv,
User Rank: Apprentice
1/6/2019 | 8:36:49 PM
Even Dentists?
I can remember dental offices and such were using a "standardized" form for new patients, which asked for SSN.  I just ignored it.  But SSN for a dental office?  Sheesh.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/7/2019 | 8:34:12 AM
SSN for medical use
There is a specific purpose involved, not good, and it is for potential malpractice suits. 
RSR55
50%
50%
RSR55,
User Rank: Guru
1/7/2019 | 9:52:50 AM
Re: Even Dentists?
Your medical insurance company will need your SSN and for those covered by your policy for compliance with current law, but medical and/or dental practices should NOT require it from you.  Just politely say No.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/7/2019 | 1:16:29 PM
Required Data
Only harbor data required to perform the business function. As the article denotes there is really no reason for a hotel to keep passport information. If you can minimize the amount of sensitve data stored at the company you won't have to rely on encryption as heavily to be your saving grace.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/7/2019 | 1:26:17 PM
Re: Even Dentists?
There is no REQUIREMENT for your number according to Clark Howard in Georgia.  People just assume so and put the numbers in. 
John Lenn
50%
50%
John Lenn,
User Rank: Apprentice
1/9/2019 | 5:42:17 AM
5.25 million unencrypted passport numbers

Marriott also believes that about 5.25 million unencrypted passport numbers were included in those records. Approximately 20.3 million encrypted passport numbers were also compromised.

Additionally, approximately 8.6 million encrypted payment cards were involved in the breach, but there is no evidence that the hackers have the mechanism to decrypt those numbers. This was the news that has been disclosed by marriot on november

Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9016
PUBLISHED: 2020-02-16
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
CVE-2020-9013
PUBLISHED: 2020-02-16
Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.
CVE-2020-9007
PUBLISHED: 2020-02-16
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
CVE-2020-9012
PUBLISHED: 2020-02-16
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
CVE-2019-20456
PUBLISHED: 2020-02-16
Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking.