Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Massive Starwood Hotels Breach Hits 500 Million Guests

Among the unknowns: who is behind the breach and how many of the affected records have been sold or used by criminals.

This is a developing story. Please check Dark Reading for updates.

More than 500 million guests of Starwood Hotels had their personal information exposed in a breach that stretched from 2014 until this past September. Starwood parent Marriott International disclosed the breach Thursday with an announcement that provided some details but left many questions unanswered.

"For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ("SPG") account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences," Marriott noted.

The company also said that for an undisclosed number of guests, the accessed information includes payment card numbers and expiration dates, though that information was protected by AES-128 encryption. That comforting detail was tempered somewhat by the company's admission that it cannot rule out the possibility that both keys necessary for decryption were also taken in the breach.

Among the information not disclosed or unknown is precisely who is behind the breach and how many of the affected records have been sold or used by criminals.

Marriott announced the purchase of Starwood in November 2015, with the deal closing in September 2016, some two years after the breach began. While Marriott International's stock took a hit on yesterday's announcement, falling around 7% from Wednesday's close, it did not see a substantial, immediate loss. Of course, the breach disclosure came far too late to have an effect on how much Marriott was paying for Starwood, unlike the impact of a massive security breach on the sale price of Yahoo when it sold its Internet business in 2017. 

"This is yet another example of why it is critical that companies perform cyber due diligence prior to an acquisition or investment," says Jake Olcott, vice president of communications and government affairs at BitSight. "Understanding the cybersecurity posture of an investment is critical to assessing the value of the investment and considering reputational, financial, and legal harm that could befall the company."

The amount and nature of the data taken in the breach could have an impact far beyond the financial information sold on the Dark Web. "The personal data obtained in one breach could be cross-referenced with data obtained from another breach and other widely publicized private sector breaches, and the Marriott breach only makes their task that much easier and more likely to succeed," says Michael Magrath, director of global regulations and standards at OneSpan.

And that cross-referencing could have implications beyond the business realm. "This is much more than a consumer data breach. When you think of this from an intelligence-gathering standpoint, it is illuminating the patterns of life of global political and business leaders, including who they traveled with when and where," says Michael Daly, CTO, cybersecurity and special missions, at Raytheon Intelligence, Information & Services. "That is incredibly efficient reconnaissance-gathering and elevates this breach to a national security problem."

While Marriott says it has reported the breach to law enforcement agencies and is cooperating with their investigations, legal fallout seems likely around the world. Class-action lawsuits are almost certain in the US, and many in the international business community will be watching the EU as regulators begin their investigations into what may be the first large test of the penalties possible under GDPR.

Email notifications have begun for affected customers, Marriott says. In addition, the company has set up an informational website and is offering guests free enrollment in WebWatcher for one year.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JimDD
50%
50%
JimDD,
User Rank: Author
11/30/2018 | 12:50:54 PM
That many?
The thing that I find so amazing is not that there was a big breach but that approximately 12.5% of the world's population stayed at a Starwood between 2014 and 2018. 
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7245
PUBLISHED: 2020-01-23
Incorrect username validation in the registration processes of CTFd through 2.2.2 allows a remote attacker to take over an arbitrary account after initiating a password reset. This is related to register() and reset_password() in auth.py. To exploit the vulnerability, one must register with a userna...
CVE-2019-14885
PUBLISHED: 2020-01-23
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information...
CVE-2019-17570
PUBLISHED: 2020-01-23
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue...
CVE-2020-6007
PUBLISHED: 2020-01-23
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
CVE-2012-4606
PUBLISHED: 2020-01-23
Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerability which could allow local users with access to a guest operating system to gain elevated privileges.