Mariott Hotels this morning admitted encrypted and unencrypted personal information on 500 million customers who made reservations at one of its Starwood Hotels has been copied over four years from one of its databases.
In a release the company said that for approximately 327 million of these guests the stolen information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences.
For some, the information also includes payment card numbers and payment card expiration dates. The payment card numbers were encrypted using Advanced Encryption Standard encryption (AES-128), Marriott said. “There are two components needed to decrypt the payment card numbers, and at this point, Marriott has not been able to rule out the possibility that both were taken.”
For the remaining guests, the information was limited to name and sometimes other data such as mailing address, email address, or other information.
Marriott has reported this incident to law enforcement and begun notifying regulatory authorities. It has already notfied the office of the Canadian privacy commissioner. Customers are being notified by email.
“Marriott is also devoting the resources necessary to phase out Starwood systems and accelerate the ongoing security enhancements to our network,” the statement said. Marriott bought the Starwood hotels and resort chain in 2016.
The company said it discovered something wrong on Sept. 8, when an internal security tool detected an attempt to access the Starwood guest reservation database. Investigating with the help of outside security experts it realized there had been “unauthorized access to the Starwood network since 2014 by “an unauthorized party … who had copied and encrypted information, and took steps towards removing it.
On November 19 Marriott decrypted the file or files it found and determined that the contents were from the Starwood guest reservation database.
The Starwood brand includes W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels.
A dedicated call centre has been set up to answer customer questions.
Hotels are common targets for thieves because their large databases include credit card numbers. Common attack points are the reservation systems, including point of sale devices where guests swipe credit cards either at the front desk or in restaurants. Websites are also a possible entry point.
In 2017 InterContinental Hotels Group acknowledged 1,000 of its properties around the world had been compromised.
Online hotel booking sites are also targets. In June Paris-based FastBooking, which makes reservation software, said an attacker used a vulnerability in an application hosted on its server to install a tool allowing data to be exfiltrated. In 2017 Sabre Hospitality Solutions, which provides a reservation system for a number of hotel brands include the Four Seasons, acknowledged a breach.
Ryan Wilk, vice-president of customer success for Vancouver-based NuData Security, a Mastercard company, noted in a statement that the hospitality sector has been hit hard this year, with breaches at such hotels as the Prince, Radisson, and Intercontinental. “This news needs to remind merchants and other companies transacting online that their systems are never entirely safe from breaches; these can happen at any time, and companies need to have their post-breach process ready. This plan includes the implementation of a stronger verification framework so they can still correctly authenticate their good users despite potentially stolen credentials. This sort of data exposure is why so many organisations – from the hospitality sector through to eCommerce companies, financial institutions and major retailers – are layering in advanced security solutions, such as passive biometrics and behavioural analytics that identify customers by their online behavior thus mitigating pos-breach damage as hackers are not able to impersonate individual behavior.”
This is a stark reminder CIOs and CISOs have to be extremely vigilant in monitoring their networks, said Theo Van Wyk, chief technology officer for security at Toronto-based integrator Scalar Decisions. “Skilled hackers may penetrate even a well-designed system and remain quiet for months, slowly mapping networks and then quickly extracting as much data as possible before being detected. That’s why it is important for companies to implement robust security protocols, but also to monitor and update them on a regular basis.”
“The question every CEO and board of directors must be asking is how fast their security operations team can detect these compromises and neutralize the threats,” said Chris Petersen, co-founder and chief product and technology officer at LogRhythm. “Security operations teams lacking sophisticated analytics that drive accurate threat detection – that are also not enabled via modern workflow automation – don’t stand much of a chance.”