TravelinSperry

I'm numb to all these breaches. My data was compromised via British Airways a few months ago... and numerous sites before them. Now Marriott. I'm sure my social, passport, ccs etc are all floating around the dark web. And I'm sure most of you have your data right alongside mine. It's absurd, but it won't stop. The hackers are better than the CTOs. Much better.

Anyway, we're not responsible for unauthorized cc spend anyway. So unless true identity fraud starts taking place nothing really to be done at this point. It's not like we can change our social or passport #s .

phltraveler

The info.starwoodhotels.com site also states that the breach was in the Starwood guest reservation database. Some countries like the UK require hotels to take down passport information and retain it for a minimum of 12 months (Source). This is actually common in a lot of the EU.

So even if the 3TA didn't send passport info to Starwood/Marriott or the Marriott.com/Starwoodhotels.com sites didn't have the passport info saved - if you stayed at Starwood hotels in the affected period, it may have been added to the reservation record by the front desk clerk anyways.

naumank

CJKatl

I do the same, which means I always need to check the final folio because hotels do not always change the cc even when it is presented at check-in and the agent is told to swipe it because it is a different card.

rny321

Although I can't control what happens to many aspects of my personal info, I try to minimize the damage when some of it is compromised. Are hotels required to keep the passport info in a readily accessible database or can it be stored offline?

CJKatl

My passport had to be presented and was copied in many locations, including Thailand and China, although I do not remember if it needed to be included in the reservation. However, I made a reservation for my sister over the summer at the Prague Sheraton. She had dropped off the phone and I did not have their passport numbers. The agent knew we were going to call back to add those. A few hours later the hotel manager sent an email stating the numbers needed to be in the reservation and needed to match what was presented at check-in, so I know for sure that at least for the Prague Sheraton the information needed to be included in the reservation.

TravelinSperry

Exactly. The primary issue of all this is identity theft. If a thief has enough info (SS#, Passport, addresses, etc.) they could attempt to pretend they are you and open credit lines using your info. Then they could run up credit and not pay and the institution may go after you (thinking you're the one who did it). If it happens it's a long drawn out process to prove it wasn't you. With that said, banks (etc.) oftentimes put you through the 5 question security check which the thieves need to get through (and that info is not always avail on the data they stole). In fact, I even sometimes get my 5 questions wrong as they sometimes go back decades. So even with our passport # and ss#, etc. - it's not that easy to imitate someone.

If you're really worried you can join an identity theft service or buy an umbrella policy that covers Identity theft.

I think most people just get upset that their data was stolen and they don't like the feeling of it being out there. But in reality, it's a very small % of people who are ultimately victims of identity theft (but for those who are it's a huge headache). I had a friend who was and it took her over a year of work and some real funds to straighten it out.

SS255

My new passport just arrived yesterday. What a fluke of timing!

bozacksmith

Geez, from someone in the cybersecurity field and has done breach investigations this is a bit ridiculous. Yes it was under the SPG IT umbrella so it is harder to point blame but it also depends on what the merger dictated within the IT groups, this isn't abnormal to have bad guy lurking for years in a network. I had just heard that they think their decrypt keys (for credit cards etc) may have been leaked and compromised which is a total ... how on earth does that even happen as those are part of the golden keys to any orgs kingdom. I dealt with the last SPG POS breach and moved on but I am just done with the whole Marriot merger and after this year will have shifted everything away.

For anyone that is worried if this exposes your info, I almost guarantee your info is already out there somewhere anyways by now. This I am sure will climb above the 500 million....

Here is also a better article as Krebs specializes in cyber investigative reporting:
https://krebsonsecurity.com/2018/11/...4-year-breach/

kaizen7

TravelinSperry

We get 1 year of webcatcher monitoring due to the breach. Enroll here:
https://answers.kroll.com/us/index.html

frenchft

Accenture and Marriot Management... Merger : failure / Technical due diligence during acquisition : Failure / Data protection since Merger : Failure.
They won a BONVOY to court! Well desserved!
Results : GDPR HUGE fine + Class action + Individual cases with EU.
The 100s of millions they will possibely have to pay will teach them the hard way that guest and their data are more important than anything else.
I still don't understand why the Marriott CEO is still running the company... let's see the next quarter financial results and let's hope the shareholders will wake up and open their eyes.

why they didn't even send us an email and we have to read the specialised website to learn it?
Disgusting lack of respect... Again. Period. "They Hang with us as he said"...

frenchft

anyone has the Data Privacy Officer at Marriot (for EU customers) email ?

Bravada04

So now KROLL wants me to send all my information via email?! Credit Card info...etc., Just a continued circle.

maracle

It's fascinating to see SPG enthusiasts somehow blaming Marriott for the mess Starwood created. It seems like the merger is likely to have exposed a years long failure by Starwood to secure customer data.