Kagehitokiri

to clarify, in 2014 multiple hotel chains discovered malware on point of sale systems (processing credit cards) that stole data

most are unaware of what china does (including but not limited to state level) especially with focus on russia

when did starwood first announce considering sale?

transportprof

Over the weekend, I noticed a declined negative charge from Marriott on my VISA card, the same one that I had used in my past Marriott bookings via their compromised database.

Called my bank today, and they said that it was an attempt to credit money back to my account (around $30) but since there was no corresponding charge for a similar/related amount, they declined the credit. I asked whether they were taking extra precautions because of the Marriott data theft and the answer was yes. I feel pretty confident that they will make sure my account isn't misused by the scammers.

Has anyone else noticed funny business from Marriott on their cards that were compromised through the data breach?

UPDATE: I called the number on the email that had officially notified me of the data breach to report this suspicious activity. The agent was very friendly, but could not help me because "systems were down". They took my contact information and promised someone would call just as soon as the systems were working again. It's been >24 hours now and no contact has been made!

MasterGeek

MasterGeek

looks like everyone forgot and moved on, which is why companies don't do more to protect our personal information.

daloosh

Stolen: 5 million unencrypted passport numbers and 20.3 million encrypted ones, with it being unclear whether encryption keys were stolen as well. It's massive, and likely not the last time we hear of an event like this one.

C17PSGR

Well once people realized it was a state actor, they realized it implicates other issues.

But ... think about all the places a state actor can obtain passport numbers and how insecure they are. I think about the countries I've been in since the December and can't imagine they have sophisticated security. Just last week, a hotel was making three copies of my passport when I checked in. One was for the front desk, one was for the back office, and one gets turned into the government daily.

If people were concerned, governments would agree hotels have no obligation to keep passport info.

enpremiere

The call canter is unaware of this and doesn't know about that tool at all. The agent that I spoke to kept trying to send me to the privacy page on Marriott's main site .

Kagehitokiri

looking up passport number = another way for it to be stolen if it hasnt been

or for new breaches to happen depending on how it is being stored

at least not ~300 million and will hopefully have at least some impact on security in future

hopefully europe also implements some new changes that all companies comply with

is there some good recent coverage?

C17PSGR

I believe the US and Austrialian governments have stated this is a state actor as well as Reuters, Bloomberg,NY Times, Washington Post, and several news organization. There are no patterns of criminal fraud and no reports on here that Amex or Chase are replacing credit cards, which they would obviously be doing if they were exposed to fraud since the banks are the ones who take a loss. Have you heard anything out of the European privacy officials after this first came out? Why do you think they turned silent?

https://www.npr.org/2018/12/12/67598...ch-reports-say

As for passport numbers ... think of the countries who collect your passport number ... if you've traveled through Hong Kong or China, a state actor has your passport number. Then think of countries outside of Europe, US. Canada, Japan, etc. Has the Peruvian government database of all the passport info they collect from hotels and immigration been compromised? To quote Pink Floyd, this is just another brick in the wall ....

Kagehitokiri

right, hopefully there will be some changes with regards to recording it in first place, other than places that obviously will always record secretly

sounds like any stolen CCs were via other breaches

have there been any numbers given (for CCs etc) other than passports?

margarita girl

OK, this is downright creepy. As I am reading this, I am in the Dept of Chemistry bar at the JW Emerald Bay and this song is playing in the bar. It's not Pink Floyd but a remake which I've never heard before, but wow!

C17PSGR

unfortunately. .I'm not there

NdaNo

OK, here's the deal. There never was a data breach. The file they "found" was created as part of the due diligence process when Marriott and others were evaluating Starwood for acquisition. Ask yourself what hacker capable of penetrating deep into a secure data center and gaining total access to the database would then extract a copy of the data, encrypt it and then leave it there? No hacker ever. Because there has been no evidence that any of this data has ever been found outside of Starwood/Marriott, they had to invent the story that it was the Chinese and state sponsored spying. Really? The file was stored on the most secure system available to Starwood primarily because Marriott had the habit of asking for the same data over and over. So instead of going through the extract process multiple times, the original file was resent. Since all of the former IT staff had either left or been released when the file was discovered, there was no one around to tell them why it was there and they simply assumed the worst.

kennycrudup

Cool story, bro- but:
... but that, IMO, is when your claim falls apart.

UA-NYC

Count me quite interested in this poster, especially w/that particular handle.

Not sure what is falling apart about said story when I'm guessing a lot of Starwood employees were sadly made redundant by the Marriott Borg.