Some of the extended data mining breaches pursued for financial gain and done using software plants — or even sometimes using hardware plants — are a direct pursuit by criminal parties that don’t qualify as state actors (nor even as state-sponsored actors).

Hit and run data theft is only part of the picture of how some non-state actor criminals engage in data theft.

This doesn’t exclude the possibility of a state actor or state-sponsored actors being the data thief in this situation, but there is definitely no certainty that extended data theft can only be done by state actors.

A lot of illegally acquired data about real persons and their accounts is stored and sold as encrypted databases that won’t come up with paid darkweb searches even when marketed and sold via the darkweb means. It’s not unusual for criminal to criminal transactions of this sort to involve one party revealing only a very tiny sample of all the stolen data and then sending over the whole stolen data by sending over the decryption elements after being paid in full. It’s also not all that unusual for some criminals to try to blackmail targets — corporate ones too —using stolen data as a means to try to negotiate over payment terms and/or to collect payment for the data.

And even as this could have been done by a state actor or state-sponsored actor, that doesn’t absolve Marriott of responsibility for the data breach under Marriott’s “watch” too. If anything, there are elements of Marriott’s response to the data breach that invite questions about Marriott’s technology competency and maybe even its legal competency.

Trying to hide behind “.... but it was a sophisticated state actor” line only goes so far. Especially when Marriott has been holding back in ways that may be questionable.

We can play legacy SPG vs. Marriott games here all we want, but there is no doubt that Marriott has the legal and customer responsibility now as they are SPG.

While I don’t think it’s realistic that everyone who ever made a booking gets a $20,000 hotel stay in compensation, I am rather unhappy that as an Ambassador client I’ve not yet received a notification email.

Agreed, but my thinking of referencing my Ambassador was that it could be conceivable that the delay in notifying people was one of incompetence given all the problems that Marriott has with basic email.

However, for those of us with Ambasadors it would have been trivial to get your Ambassadors to manually email each of us and be ready for personal responses. It is a matter of indifference that this has not yet been done.

So should people that haven’t stayed at W, Sheraton or Westin not be effected?

Would that be “not booked at and not listed in a reservation” rather than “not stayed in”?