Attacks/Breaches

Massive Starwood Hotels Breach Hits 500 Million Guests

Among the unknowns: who is behind the breach and how many of the affected records have been sold or used by criminals.

This is a developing story. Please check Dark Reading for updates.

More than 500 million guests of Starwood Hotels had their personal information exposed in a breach that stretched from 2014 until this past September. Starwood parent Marriott International disclosed the breach Thursday with an announcement that provided some details but left many questions unanswered.

"For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ("SPG") account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences," Marriott noted.

The company also said that for an undisclosed number of guests, the accessed information includes payment card numbers and expiration dates, though that information was protected by AES-128 encryption. That comforting detail was tempered somewhat by the company's admission that it cannot rule out the possibility that both keys necessary for decryption were also taken in the breach.

Among the information not disclosed or unknown is precisely who is behind the breach and how many of the affected records have been sold or used by criminals.

Marriott announced the purchase of Starwood in November 2015, with the deal closing in September 2016, some two years after the breach began. While Marriott International's stock took a hit on yesterday's announcement, falling around 7% from Wednesday's close, it did not see a substantial, immediate loss. Of course, the breach disclosure came far too late to have an effect on how much Marriott was paying for Starwood, unlike the impact of a massive security breach on the sale price of Yahoo when it sold its Internet business in 2017. 

"This is yet another example of why it is critical that companies perform cyber due diligence prior to an acquisition or investment," says Jake Olcott, vice president of communications and government affairs at BitSight. "Understanding the cybersecurity posture of an investment is critical to assessing the value of the investment and considering reputational, financial, and legal harm that could befall the company."

The amount and nature of the data taken in the breach could have an impact far beyond the financial information sold on the Dark Web. "The personal data obtained in one breach could be cross-referenced with data obtained from another breach and other widely publicized private sector breaches, and the Marriott breach only makes their task that much easier and more likely to succeed," says Michael Magrath, director of global regulations and standards at OneSpan.

And that cross-referencing could have implications beyond the business realm. "This is much more than a consumer data breach. When you think of this from an intelligence-gathering standpoint, it is illuminating the patterns of life of global political and business leaders, including who they traveled with when and where," says Michael Daly, CTO, cybersecurity and special missions, at Raytheon Intelligence, Information & Services. "That is incredibly efficient reconnaissance-gathering and elevates this breach to a national security problem."

While Marriott says it has reported the breach to law enforcement agencies and is cooperating with their investigations, legal fallout seems likely around the world. Class-action lawsuits are almost certain in the US, and many in the international business community will be watching the EU as regulators begin their investigations into what may be the first large test of the penalties possible under GDPR.

Email notifications have begun for affected customers, Marriott says. In addition, the company has set up an informational website and is offering guests free enrollment in WebWatcher for one year.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JimDD
50%
50%
JimDD,
User Rank: Author
11/30/2018 | 12:50:54 PM
That many?
The thing that I find so amazing is not that there was a big breach but that approximately 12.5% of the world's population stayed at a Starwood between 2014 and 2018. 
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6487
PUBLISHED: 2019-01-18
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
CVE-2018-20735
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.