jr1202sr

Email Password stolen Vs. Passport, DOB, CC info, etc.

getagb

phltraveler

The issues became Marriott's when Marriott acquired Starwood two years ago in 2016.

More troubling is the point that Marriott should have caught this sooner. How was this not caught as part of due diligence, or during the integration of the Starwood Reservations system to Marriott.com/with the account linking for August 18th? The timeline clearly states that Marriott only discovered the unauthorized access on the Starwood network in September 2018, which is after Marriott merged loyalty programs with Starwod.

It's weasel words (the phrase up to) because they don't want to be accused of minimizing/downplaying/understating the impact later. I could have multiple SPG account numbers, or I could book without SPG number one time, or older records might be incomplete (where it's not clear if I'm the same John Doe on one reservation as another because there is not enough other information [address, date of birth, email, etc.] to be sure if two reservations are the same person or entirely different people), etc.

It's probably a count of the total number of data records (reservation data) from the period when they can identify the breach having started to the time when they cut it off, a simple count statement on the # of rows in the database.

jr1202sr

Awesome so you give away "some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. For some, the information also includes payment card numbers and payment card expiration dates"

and to make up for it you offer just 1 YEAR of WebWatcher and all is forgotten? Marriott is so cheap they can't even pay for lifetime monitoring or at least 3-5 years.

Tedyuscung

AmEx reports credit cards numbers not involved with this security breach so no need to replace existing card, yet!

phltraveler

Well according to the info.starwoodhotels.com domain, credit card data was on some of the reservations, but it was AES encrypted and required at least two pieces of information (keys) to decrypt. However, according to the same site, Marriott cannot definitively prove that the people who stole the records also didn't have access to these encryption keys (and therefore would be able to decrypt the credit card data to a usable/readable format).

Amex, Chase, and other issuers will probably wait for signs of misuse in a pattern (e.g. seeing a fraud pattern on their cardholders who had stayed at SPG properties from 2014-2018) or for Marriott to report that there is forensic evidence on the Starwood servers that the hackers did access/use the information required to decrypt the card numbers before going to mass reissues.

EuropeanPete

Keyser

i don't have my passport information on my spg/marriott account but i do have my credit card info....my card is due to expire in the next 3 months so it may be a good idea to just request them to send a new one now....

GUWonder

If the hacking party knows its criminal marketplace and has what they need to use Marriott's stored bank card info -- they won't dump the stolen card data in one whole bunch.

That's interesting, since Marriott's PR statements on this earlier today had said they weren't clear about whether or not card info had been lifted and usable too or not.

This news coming out on a Friday -- instead of earlier in the work week -- does beg questions about whether or not the timing of the public release by Marriott was intentionally set by Marriott for Friday for PR management purposes.

caw414

I have had to replace my Marriot Visa 6x in the last 2 years. I have been tring and trying to figure out the root cause

sethMCOflyer

GUWonder

It's unbelievably simple to know that major travel service providers ask for and keep a lot of customers' personal information. And it's unbelievably simple to know that such information is targeted by hackers -- criminals and even state-backed actors -- for a reason.

Maybe the information should be more properly protected (by the company wanting all such info) or perhaps even not kept at all by the company? The less you have, the less you have to simply protect? Isn't it that simple?

jr1202sr

Gigantor

No Swiss telephone number listed on info.starwood.com

rny321

Please correct me if I'm wrong, but my impression of security breaches are they are much less difficult to find when the initial exposure happens than in a forensic audit long afterwards. I had always assumed that it was like finding an error in someone else's code that happened a long time ago. Depending on the complexity and importance of the software, financial services companies will sometimes completely rewrite pricing or hedging models instead of using something developed by a predecessor. Marriott has performed poorly in a lot of ways since the merger and this is one more example of a lack of competence, but in this instance Starwood executives deserve most of the blame since it was their company's IT and management that allowed the backdoor into customer's data.