Nov 30, 2018, 5:05 am
Last edit by: MasterGeek
From Starwood Lurker team :
Please visit info.starwoodhotels.com for more information about this incident, available resources and steps you can take.
Marriott has announced a massive breach of data belonging to 500 million guests who stayed at hotel brands including W, Sheraton, and Westin.
Marriott announced on Friday that it had "taken measures to investigate and address a data security incident" that stemmed from its Starwood guest authorization database.
The company said it believes that around 500 million people's information was accessed, including an unspecified number who had their credit card details taken. It affects customers who made bookings on or before September 10, 2018.
http://uk.businessinsider.com/marriott-data-breach-500-million-guests-affected-2018-11?r=US&IR=T
https://www.prnewswire.com/news-releases/marriott-announces-starwood-guest-reservation-database-security-incident-300758155.html
You can enroll in the "identity" monitoring service provided by Marriott due to this breach here, it cannot be called "credit monitoring" because it doesn't provide access to viewing credit bureau report data (as held by Equifax, TransUnion, Experian) nor notifications when credit report data changes :
https://answers.kroll.com/us/index.html
Please visit info.starwoodhotels.com for more information about this incident, available resources and steps you can take.
Marriott has announced a massive breach of data belonging to 500 million guests who stayed at hotel brands including W, Sheraton, and Westin.
Marriott announced on Friday that it had "taken measures to investigate and address a data security incident" that stemmed from its Starwood guest authorization database.
The company said it believes that around 500 million people's information was accessed, including an unspecified number who had their credit card details taken. It affects customers who made bookings on or before September 10, 2018.
http://uk.businessinsider.com/marriott-data-breach-500-million-guests-affected-2018-11?r=US&IR=T
https://www.prnewswire.com/news-releases/marriott-announces-starwood-guest-reservation-database-security-incident-300758155.html
You can enroll in the "identity" monitoring service provided by Marriott due to this breach here, it cannot be called "credit monitoring" because it doesn't provide access to viewing credit bureau report data (as held by Equifax, TransUnion, Experian) nor notifications when credit report data changes :
https://answers.kroll.com/us/index.html
Starwood/Marriott Data Breach 500 Million Guests affected, Marriott fined £18.4m
Nov 30, 2018, 9:54 am
#106
FlyerTalk Evangelist
Join Date: Sep 2007
Location: BOS
Programs: DL DM 2MM, Marriott LT Titanium, Hertz PC, Avis PC
Posts: 15,165
Nov 30, 2018, 9:55 am
#107
Join Date: Aug 2002
Location: YYZ
Programs: BA Gold/Marriott Gold/HH Diamond/IC Plat Amba
Posts: 5,988
In 2014 I had my Starwood account hacked and most of the points transferred to Etihad. I phoned them and the points were put back into a new account although no explanation was given so Starwood had to know they were breached even back then
Nov 30, 2018, 9:56 am
#108
Join Date: Nov 2014
Location: lounge next door
Programs: *A Gold / ST Elite+ / OWS / EK G / HH Diam. / MR Tit / Hyatt GLOB / IHG Diam. / SL Jade / GHA Tit.
Posts: 1,523
What do you think? Amateurs ... irresponsible... and I hope they will be the first big UE fine for GDPR matters! Well deserved!
Nov 30, 2018, 9:56 am
#109
Join Date: Dec 2017
Posts: 745
Notepad file on the top level share folder for easy access? Just a guess.
Nov 30, 2018, 10:00 am
#110
Join Date: Jun 2016
Location: Prince Edward Island
Programs: Air Canada P25K, Hilton Honors Gold, Marriott Gold, MGM Gold
Posts: 1,582
Nov 30, 2018, 10:04 am
#111
Join Date: Nov 2014
Location: lounge next door
Programs: *A Gold / ST Elite+ / OWS / EK G / HH Diam. / MR Tit / Hyatt GLOB / IHG Diam. / SL Jade / GHA Tit.
Posts: 1,523
Accenture is removing, or trying to remove some informations... not accessible... but they were already the Starwood IT outsourcing / advisor...
Congrats to them for such a work!
https://newsroom.accenture.com/indus...on-program.htm
Congrats to them for such a work!
https://newsroom.accenture.com/indus...on-program.htm
Nov 30, 2018, 10:04 am
#112
Suspended
Join Date: Sep 2014
Programs: AC SE100K-1MM, NH, DL, AA, BA, Global Entry/Nexus, APEC..
Posts: 18,877
As I made post #48 , I don't think that it's useless finger pointing to point out that the breach started under Starwood but Starwood's liabilities are Marriott's, and express disbelief that a system that Marriott had been working on integrating with their own website/rewards IT for over two years remained compromised throughout the entire integration period, including after the Single loyalty program/website integration on 08/18, and that the security breach was only found after they had integrated the starwood reservation system/servers with Marriott.com and Marriott Rewards. Given that it's another failure on the part of the combined Marriott/Starwood from an IT perspective, groaning is going to come with the territory.....
.
And, whether one is a SPG loyalist or Marriott fan,
IMHO:
1. This merger only benefited shareholders and execs, not guests or employees
2. Arne should be tossed, along with anyone else who shared his myths and approach
3. Breach or not, Marriott IT and Customer Service was horrid before the merger and is worse now
4. For those of us who lost nights, stays, points etc with the combining of accounts, the breach is almost a "who cares" moment
5. There are severely incompetent people working at Marriott IT who, among other things, enjoy send emails suggesting using the Marriott portal to book a Westin or W or Sheraton, not the SPG site, yet when selecting a SPG property, the Marriott portal bumps you to the SPG site; who suggest that if you can't book a property, clear cookies, or my personal favourite "unplug your computer"
The list goes on as many of you and so many others can attest to.
So, for some, this 500 million whatever data breach is a freak-out. For others, it's a reminder that big "egos" made the decision to merge the companies and regardless of whether the hack was on SPG and prior to the integration/combining/whatever, IN NO WAY does it absolve Arne and his gang of the responsibility of not taking the time to get it right.
It is a fiasco and you can all choose to disagree.
Nov 30, 2018, 10:04 am
#113
Join Date: Nov 2014
Location: lounge next door
Programs: *A Gold / ST Elite+ / OWS / EK G / HH Diam. / MR Tit / Hyatt GLOB / IHG Diam. / SL Jade / GHA Tit.
Posts: 1,523
Nov 30, 2018, 10:06 am
#114
Join Date: Feb 2013
Location: Miami, FL
Programs: UA 1MM, AA Plat, Marriott LT Titanium, Hyatt Glob, IHG ♢ Amb, Hilton ♢, Hertz Pres
Posts: 6,015
I enrolled and saw breaches across numerous websites. I went back to those websites and deleted my accounts.
Nov 30, 2018, 10:06 am
#115
Join Date: Nov 2014
Location: lounge next door
Programs: *A Gold / ST Elite+ / OWS / EK G / HH Diam. / MR Tit / Hyatt GLOB / IHG Diam. / SL Jade / GHA Tit.
Posts: 1,523
Geez, from someone in the cybersecurity field and has done breach investigations this is a bit ridiculous. Yes it was under the SPG IT umbrella so it is harder to point blame but it also depends on what the merger dictated within the IT groups, this isn't abnormal to have bad guy lurking for years in a network. I had just heard that they think their decrypt keys (for credit cards etc) may have been leaked and compromised which is a total ... how on earth does that even happen as those are part of the golden keys to any orgs kingdom. I dealt with the last SPG POS breach and moved on but I am just done with the whole Marriot merger and after this year will have shifted everything away.
For anyone that is worried if this exposes your info, I almost guarantee your info is already out there somewhere anyways by now. This I am sure will climb above the 500 million....
Here is also a better article as Krebs specializes in cyber investigative reporting:
https://krebsonsecurity.com/2018/11/...4-year-breach/
For anyone that is worried if this exposes your info, I almost guarantee your info is already out there somewhere anyways by now. This I am sure will climb above the 500 million....
Here is also a better article as Krebs specializes in cyber investigative reporting:
https://krebsonsecurity.com/2018/11/...4-year-breach/
Nov 30, 2018, 10:07 am
#116
Join Date: Jan 2012
Location: Iowa City, IA
Posts: 337
I think marriott is trying to spread the blame around for this. Their statements are contradicting:
Common sense would dictate if there was proof that info was copied using unauthorized access to the Starwood database, that the contents would be from the Starwood database. You don't need to decrypt it to figure that part out. I think more than likely this breach didn't occur until Marriott purchased Starwoow, and what they really mean is that the data spans 4 years. I am an IT system administrator and I find it highly unlikely that this breach has been ongoing for 4 years straight! Not just unlikely, virtually impossible. These things are generally found out pretty quickly, though almost always after the damage is done. This would be quite the coincidence that with their major integration problems that this is a separate, unrelated incident
On September 8, 2018, Marriott received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database. Marriott quickly engaged leading security experts to help determine what occurred. Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014.
On November 19, 2018, Marriott was able to decrypt the information and determined that the contents were from the Starwood guest reservation database.
Nov 30, 2018, 10:10 am
#117
Join Date: Feb 2000
Location: Pittsburgh
Programs: Whoever Has the Best Bonus
Posts: 5,183
I had my SPG Amex used in Brazil (Amex caught it immediately and didn't let it go through) and I had no idea why. Now it seems this could be why as I only used it for my Starwood reservations in the time frame shown.
Nov 30, 2018, 10:12 am
#118
Join Date: Nov 2014
Location: lounge next door
Programs: *A Gold / ST Elite+ / OWS / EK G / HH Diam. / MR Tit / Hyatt GLOB / IHG Diam. / SL Jade / GHA Tit.
Posts: 1,523
I think marriott is trying to spread the blame around for this. Their statements are contradicting:
Common sense would dictate if there was proof that info was copied using unauthorized access to the Starwood database, that the contents would be from the Starwood database. You don't need to decrypt it to figure that part out. I think more than likely this breach didn't occur until Marriott purchased Starwoow, and what they really mean is that the data spans 4 years. I am an IT system administrator and I find it highly unlikely that this breach has been ongoing for 4 years straight! Not just unlikely, virtually impossible. These things are generally found out pretty quickly, though almost always after the damage is done. This would be quite the coincidence that with their major integration problems that this is a separate, unrelated incident
Common sense would dictate if there was proof that info was copied using unauthorized access to the Starwood database, that the contents would be from the Starwood database. You don't need to decrypt it to figure that part out. I think more than likely this breach didn't occur until Marriott purchased Starwoow, and what they really mean is that the data spans 4 years. I am an IT system administrator and I find it highly unlikely that this breach has been ongoing for 4 years straight! Not just unlikely, virtually impossible. These things are generally found out pretty quickly, though almost always after the damage is done. This would be quite the coincidence that with their major integration problems that this is a separate, unrelated incident
"In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay."
Nov 30, 2018, 10:23 am
#119
Join Date: Nov 2014
Location: New York
Programs: MB-LTT , HH-Diam., HGP-Expl.
Posts: 778
My passport had to be presented and was copied in many locations, including Thailand and China, although I do not remember if it needed to be included in the reservation. However, I made a reservation for my sister over the summer at the Prague Sheraton. She had dropped off the phone and I did not have their passport numbers. The agent knew we were going to call back to add those. A few hours later the hotel manager sent an email stating the numbers needed to be in the reservation and needed to match what was presented at check-in, so I know for sure that at least for the Prague Sheraton the information needed to be included in the reservation.
Nov 30, 2018, 10:26 am
#120
Join Date: May 2013
Location: New York
Programs: UA Silver, Marriott LTPP, Hertz Five Star
Posts: 1,077
I think marriott is trying to spread the blame around for this. Their statements are contradicting:
Common sense would dictate if there was proof that info was copied using unauthorized access to the Starwood database, that the contents would be from the Starwood database. You don't need to decrypt it to figure that part out.
Common sense would dictate if there was proof that info was copied using unauthorized access to the Starwood database, that the contents would be from the Starwood database. You don't need to decrypt it to figure that part out.
Details are lacking though. There needs to be a serious post-mortem done on this and the failure to discover it earlier.
