Among the unknowns: who is behind the breach and how many of the affected records have been sold or used by criminals.

This is a developing story. Please check Dark Reading for updates.

More than 500 million guests of Starwood Hotels had their personal information exposed in a breach that stretched from 2014 until this past September. Starwood parent Marriott International disclosed the breach Thursday with an announcement that provided some details but left many questions unanswered.

"For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ("SPG") account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences," Marriott noted.

The company also said that for an undisclosed number of guests, the accessed information includes payment card numbers and expiration dates, though that information was protected by AES-128 encryption. That comforting detail was tempered somewhat by the company's admission that it cannot rule out the possibility that both keys necessary for decryption were also taken in the breach.

Among the information not disclosed or unknown is precisely who is behind the breach and how many of the affected records have been sold or used by criminals.

Marriott announced the purchase of Starwood in November 2015, with the deal closing in September 2016, some two years after the breach began. While Marriott International's stock took a hit on yesterday's announcement, falling around 7% from Wednesday's close, it did not see a substantial, immediate loss. Of course, the breach disclosure came far too late to have an effect on how much Marriott was paying for Starwood, unlike the impact of a massive security breach on the sale price of Yahoo when it sold its Internet business in 2017. 

"This is yet another example of why it is critical that companies perform cyber due diligence prior to an acquisition or investment," says Jake Olcott, vice president of communications and government affairs at BitSight. "Understanding the cybersecurity posture of an investment is critical to assessing the value of the investment and considering reputational, financial, and legal harm that could befall the company."

The amount and nature of the data taken in the breach could have an impact far beyond the financial information sold on the Dark Web. "The personal data obtained in one breach could be cross-referenced with data obtained from another breach and other widely publicized private sector breaches, and the Marriott breach only makes their task that much easier and more likely to succeed," says Michael Magrath, director of global regulations and standards at OneSpan.

And that cross-referencing could have implications beyond the business realm. "This is much more than a consumer data breach. When you think of this from an intelligence-gathering standpoint, it is illuminating the patterns of life of global political and business leaders, including who they traveled with when and where," says Michael Daly, CTO, cybersecurity and special missions, at Raytheon Intelligence, Information & Services. "That is incredibly efficient reconnaissance-gathering and elevates this breach to a national security problem."

While Marriott says it has reported the breach to law enforcement agencies and is cooperating with their investigations, legal fallout seems likely around the world. Class-action lawsuits are almost certain in the US, and many in the international business community will be watching the EU as regulators begin their investigations into what may be the first large test of the penalties possible under GDPR.

Email notifications have begun for affected customers, Marriott says. In addition, the company has set up an informational website and is offering guests free enrollment in WebWatcher for one year.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights