Marriott announces data breach impacting 500 million hotel guests

The company has determined that hackers had unauthorized access on Starwood’s guest database dating back to 2014.

The Marriott Hotel chain announced Friday that information contained in a Starwood Hotels database was compromised, potentially affecting up to 500 million guests.

The company has determined that hackers had unauthorized access on Starwood’s guest database dating back to 2014. Hackers copied and encrypted guest information, then “took steps towards removing it,” the company said. Marriott acquired Starwood in 2016.

Marriott on Sept. 8 received an alert from a security tool indicating an outsider was trying to access Starwood’s guest reservation database. That alert was enough for the company to consult outside security experts, who ultimately determined that thieves had been inside the database for roughly four years.

For roughly 327 million of the 500 million guests affected, hackers stole information including their name, mailing address, phone number, email address, passport number, Starwood account information, date of birth, gender, arrival and departure information, reservation date and communication preferences, the company said. Payment information also was compromised for many of those guests.

Marriott in its statement said it is still investigating the breach. The company also said it has been working with law enforcement and that is “has begun notifying” regulatory authorities about the incident.

A stipulation in the European Union’s General Data Protection Regulation requires firms to report within 72 hours a data breach involving information about EU citizens. It remains unclear precisely when Marriott began alerting regulators about this incident but GDPR threatens fine of up to 4 percent of global revenue of 20 million, whichever is higher, to organizations that violate the rules.

Exactly what constitutes a data breach that must be reported within 72 hours is a subject of ongoing debate in meetings and boardrooms throughout the private sector.

The company said it will begin on Friday notifying guests whose email addresses were in the Starwood database. It also has prepared a call center capable of helping victims in multiple languages.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure