Bowgie

This may sound dumb, but what is the harm of my passport number being out in the hands of hackers?
In the news today, Senator Chuck Schumer says Marriott should pay everyone's fee for a new passport.

yosithezet

EuropeanPete

GUWonder

Sen. Schumer is a sort of clown, and it can be sort of dangerous when you get in between the clown and the camera being chased by the clown.

With a passport number for a named person whose birthdate is known, accessing their travel records to some countries may become much, much simpler.

For example, if I were in the TATL criminal enterprise of home break-ins aimed at the relatively wealthy Germans with vacation homes in Florida, I could pretty much figure out when to rob the German houses of such Germans and the Florida homes of such Germans subject to this data breach if I had the passport numbers of those German guests who have been staying at Marriott properties during this year or last year. And that is with me using just publicly-available data. This wouldn't work like that if using a US passport, but there are other ways to use a US passport number to engage in fraud and theft of various sorts.

With a US passport number and name of the person, it may be easy to create a fake biodata passport image with a photo substitution included and use that along with some other data to open or access accounts of one or more persons in some jurisdictions. US passport number and SSN and a little access to US credit reporting data can be more useful to a knowledgeable criminal than even many in law enforcement would realize until it hits them over the head.

With all due respect, the above claim about Marriott having no obligation to inform of a breach earlier is a questionable claim at best. Marriott doesn't operate only in one corporate-kiss-up jurisdiction. It operates in a variety of jurisdictions and is subject to the legal and regulatory authority in many, many countries which aren't just one's own.

GUWonder

Disgruntled employees -- or those expecting to soon be disgruntled employees -- of the company or of the company's contractors has been a possibility for data breaches, and the motivations for doing something like this can vary. Even without an employee/contractor being disgruntled, some such persons may have done such a thing for reasons that had nothing to do with criminal or espionage activity (if even different), but it ended up being discovered and used for such activity.

GUWonder

So Marriott now sends emails, at least to those it may think are covered by GDPR. I guess this is Marriott's idea of informing customers within 72 hours of breach recognition.

EuropeanPete

GUWonder

I haven't, but some have gotten the following: https://loyaltylobby.com/2018/12/02/...rity-incident/

My guess is that Marriott is having to pay for more billable hours from more lawyers in more jurisdictions than usual. but I won't have to guess for very long. Whatever gets confirmed, Marriott has shown to have lost the Boy Scouts' way: "be prepared".

CJKatl

Correct. And those legal obligations have nothing to do with your being an Ambassador member, which provides you with some benefits per the T&Cs, but you keep stating Marriott should have reached out to you as an Ambassador member through your Ambassador, which is not so. And it makes sense that they do not want several different channels providing information so they are not creating a special earlier communication to Ambassador members or through Ambassadors, which would create confusion.

GUWonder

The liability arising from a poorly-met/unfulfilled legal obligation arising from a recognized data breach may vary based upon the type of relationship a company (and its agents) has with a customer.

flyme2

I just typed Marriott into the Chrome search field and landed on someone's search page complete with name, status and number of points. The person is not known to me, hence this is not a residual page from a previous search. Are my account details visible to others as well? Marriott's IT department has truly come off the rails.

CJKatl

I would bet my law degree that any difference in obligation to different customers has absolutely nothing to do with the poster being an Ambassador member or having an Ambassador. Ambassador member benefits are contractual between the member and the company, have to do with the marketing program only and are spelled out in the T&Cs.

GUWonder

JBord

And SPG didn't find it for 2 years prior. Perhaps is was difficult to detect and they figured it out as they were going through the IT integration? Probably the first time the Marriott side really dug into the SPG reservation system since it was doing it's job up until that point. I would assume they had separate IT protocols and teams up until August. It doesn't excuse Marriott from any liability, but I'm simply trying to point out some reality here.

For what it's worth, I agree that Marriott needs to send out emails. Probably the lawyers are working on that now. It affects me personally as I've made many SPG reservations during those years, and am wondering if and how I'm affected. But any damage is done at this point so I'm not sure it matters to me if an email was sent now or a week from now. Maybe the hackers have quietly been sitting on my credit card info for years and now that the announcement is made they're going to start spending like crazy? I will say, however, for those who had passport info on reservations, that's a more serious issue, so I hope they inform and provide some type of remedy to those people quickly.

J S

Given the total and complete mess that now passes for Marriott/Starwood's loyalty program, I am imagining the hackers currently trying to get the stay history corrected on the 327,000,000 accounts Starriott gave them access to.

Heck, let's just call this an enhancement to the mess of a program. Congratulations, now none of us have to worry about our missing stays.