Slashdot Mirror
Marriott Says 500 million Starwood Guest Records Stolen in Massive Data Breach (techcrunch.com)
An anonymous reader writes: Starwood Hotels has confirmed its hotel guest database of about 500 million customers has been stolen in a data breach. The hotel and resorts giant said in a statement filed with U.S. regulators that the "unauthorized access" to its guest database was detected on or before September 10 -- but may have dated back as far as 2014. "Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014," said the statement. "Marriott recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it."
Specific details of the breach remain unknown. We've contacted Starwood for more and will update when we hear back. The company said hat it obtained and decrypted the database on November 19 and "determined that the contents were from the Starwood guest reservation database." Some 327 million records contained a guest's name, postal address, phone number, date of birth, gender, email address, passport number, Starwood's rewards information (including points and balance), arrival and departure information, reservation date, and their communication preferences.
Specific details of the breach remain unknown. We've contacted Starwood for more and will update when we hear back. The company said hat it obtained and decrypted the database on November 19 and "determined that the contents were from the Starwood guest reservation database." Some 327 million records contained a guest's name, postal address, phone number, date of birth, gender, email address, passport number, Starwood's rewards information (including points and balance), arrival and departure information, reservation date, and their communication preferences.
I'm a winner again in the data breach sweepstakes. I feel special.
Are they competing for Guinness World Record holder? Yahoo got top spot... until now.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Why are the storing all that data in the first place?
In order to prevent this from happening, there needs to be much stiffer penalties for incidents like this. I am not talking financial ones but criminal ones. Subject the entire senior management to arrest and criminal prosecution for failing to take reasonable safeguards against incidents like this. Then you watch how serious IT departments will take information security.
My guess is - no punishment at all. Companies now know that they don't have to spend any money on data security, since there won't be any consequences when they get hacked.
I think that was the contract I was on when I worked at IBM years ago. I was managing IRS and TSA security servers for the first year but managing the servers was outsourced to India so I switched to a 100% telecommute contract with Starwood.
Regardless, working 100% was pretty much hell as every communication was business only and very strict so there was no camaraderie amongst the team. It pretty much killed any desire to telecommute after that.
[John]
Shit better not happen!
Hacked in 2016 too!
Time for new management since they clearly didn't learn from that mistake.
That's two breach headlines this week. These happen so often it's ridiculous. This is why you should never use your real card number for anything.
For online I always advocate to use PayPal, Visa Checkout, Masterpass or other similar payment system where you do not provide your card number to the merchant. If they don't support any this is where I would use a Privacy virtual debit card number. This uses disposable debit card numbers so that you don't have to worry about it being reused after a breach. I've been using it for about 6 months and love it. Shameless referral link with $5 back: https://privacy.com/join/JWVHW
And of course there is always the compromised POS systems. Keep using chip, NFC, MST, gift cards and cash, people. Never swipe a real card in store nor give out your real card number online!
People claiming we need stiffer penalties, more prosecution, more feet to the fire.
Fine, do all of that. Still wont change the fact that computer systems will continue to be hacked/breached/accessed without authorization or consent.
It is just how things are.
It is a basic truth of any system.
Life - death and taxes
Legal - only true winners are the lawyers
computers (hardware & software) - if you build it it will be exploited
Even the scientist are getting into the action - bio-engineering anyone.
Basically, if someone feels they can make something better than it is or exploit it for some sort of gain, they will do it.
I just don't understand why any of these breach stories are even a surprise anymore.
As a math guy I see this whole "problem" as derivatives and limits, and we approaching 0 when it comes to what we know as the identification & financial systems. These systems, as we know them, are slowly approaching 0 value and there will be an event horizon from which these systems will implode.
... and STILL nobody truly gives a shit. Until their identities get stolen.
I tend to rant.
More companies need to convert to blockchain systems to prevent this sort of hacking.
Time to legislate not being legally allowed to keep data for longer than needed for a transaction.
We simply cannot keep data safe - so why keep it longer than needed at all?
It seems pretty clear to me that 'data security' doesn't exist, and any data stored anywhere that isn't literally air-gapped is fair game for any script-kiddie with an Internet connection (and even then, air-gapped doesn't exclude you from 'social engineering' and phishing attacks). So how do we fix this? Is it really just a matter of humans being careless, and we need a judicial (perhaps a literal use of the word) application of the Clue-by-Four to administrators and executives? Or are the programmers and systems administrators to blame?
Last I heard around here, it's entirely likely that nothing is safe, not critical infrastructure systems, not even military systems. So what the actual fuck needs to happen, here? How do we fix this?
I carry an abbreviated ID, a color printed scanner copy of my driver's license that has the date of birth, license number, and another ID number blanked out. It has printed on the top:
Numbers removed to protect against identify theft
You can view license in my hand to verify authenticity
Here is a mockup picture of the license:
https://i.imgur.com/yReDmAx.pn...
If any business establishment will not accept it, wants to make a photo copy of my real license, or wants to copy information off the origional, I refuse and they loose my business. I do not let them view the real license in my hand long enough for them to copy data off of it.
I purchased something at BestBuy once and they asked to see my driver's license. He looked at it and then subtly held it down by a camera and photo copied it. This abbreviated system stops them from taking such privileges with my documents.
I've been getting some wonderful spam telemarketing calls telling about wonderful vacation opportunities based on being selected as a Marriott or Wyndham customer.
The spammers are behind the break in or bought the list from the hackers who broke in.
Security researchers have been looking for years to see who owns certain "open" shared databases on AWS.
Apparently Marriot just stepped forward to claim ownership.
Now that our data is effectively out in the open - there is little to identity us from a trustworthy source. I wonder how banks (et al) are changing to address this. Seriously - if a bank or cellphone company called me to ask where my payment is, I'd ask them to prove "I" opened the account.
My data has been leaked multiple times. Ticketfly, Anthem, Marriott, Experian, and others I can't remember. (plus Amazon leaked my email address -- via a bug in their "forgot password" feature that returned an error message if the account didn't exist, which I reported to them... thank you... still waiting for my $$$).
So what data isn't public? Now that everything is public, nothing is private (If everyone is Super, then no-one is)
Those responsible for sacking the people who have just been sacked have been sacked.
Obviously they have no institutional memory and haven't learned from their past mistakes.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
It's really 500 million RECORDS. That's a big difference... that's still a lot, but the number of different people actually involved in the breach is likely much, much lower.
Also, we keep hearing "going back to 2014" - which means somebody was accessing it back then, not that that represents the oldest information.
I really can't stand the ambiguity/imprecision of these sort of reports.