Slashdot Mirror
Marriott Says 500 million Starwood Guest Records Stolen in Massive Data Breach (techcrunch.com)
An anonymous reader writes: Starwood Hotels has confirmed its hotel guest database of about 500 million customers has been stolen in a data breach. The hotel and resorts giant said in a statement filed with U.S. regulators that the "unauthorized access" to its guest database was detected on or before September 10 -- but may have dated back as far as 2014. "Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014," said the statement. "Marriott recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it."
Specific details of the breach remain unknown. We've contacted Starwood for more and will update when we hear back. The company said hat it obtained and decrypted the database on November 19 and "determined that the contents were from the Starwood guest reservation database." Some 327 million records contained a guest's name, postal address, phone number, date of birth, gender, email address, passport number, Starwood's rewards information (including points and balance), arrival and departure information, reservation date, and their communication preferences.
Specific details of the breach remain unknown. We've contacted Starwood for more and will update when we hear back. The company said hat it obtained and decrypted the database on November 19 and "determined that the contents were from the Starwood guest reservation database." Some 327 million records contained a guest's name, postal address, phone number, date of birth, gender, email address, passport number, Starwood's rewards information (including points and balance), arrival and departure information, reservation date, and their communication preferences.
I'm a winner again in the data breach sweepstakes. I feel special.
Are they competing for Guinness World Record holder? Yahoo got top spot... until now.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Why are the storing all that data in the first place?
In order to prevent this from happening, there needs to be much stiffer penalties for incidents like this. I am not talking financial ones but criminal ones. Subject the entire senior management to arrest and criminal prosecution for failing to take reasonable safeguards against incidents like this. Then you watch how serious IT departments will take information security.
I think that was the contract I was on when I worked at IBM years ago. I was managing IRS and TSA security servers for the first year but managing the servers was outsourced to India so I switched to a 100% telecommute contract with Starwood.
Regardless, working 100% was pretty much hell as every communication was business only and very strict so there was no camaraderie amongst the team. It pretty much killed any desire to telecommute after that.
[John]
Shit better not happen!
That's two breach headlines this week. These happen so often it's ridiculous. This is why you should never use your real card number for anything.
For online I always advocate to use PayPal, Visa Checkout, Masterpass or other similar payment system where you do not provide your card number to the merchant. If they don't support any this is where I would use a Privacy virtual debit card number. This uses disposable debit card numbers so that you don't have to worry about it being reused after a breach. I've been using it for about 6 months and love it. Shameless referral link with $5 back: https://privacy.com/join/JWVHW
And of course there is always the compromised POS systems. Keep using chip, NFC, MST, gift cards and cash, people. Never swipe a real card in store nor give out your real card number online!
... and STILL nobody truly gives a shit. Until their identities get stolen.
I tend to rant.
It seems pretty clear to me that 'data security' doesn't exist, and any data stored anywhere that isn't literally air-gapped is fair game for any script-kiddie with an Internet connection (and even then, air-gapped doesn't exclude you from 'social engineering' and phishing attacks). So how do we fix this? Is it really just a matter of humans being careless, and we need a judicial (perhaps a literal use of the word) application of the Clue-by-Four to administrators and executives? Or are the programmers and systems administrators to blame?
Last I heard around here, it's entirely likely that nothing is safe, not critical infrastructure systems, not even military systems. So what the actual fuck needs to happen, here? How do we fix this?
I've been getting some wonderful spam telemarketing calls telling about wonderful vacation opportunities based on being selected as a Marriott or Wyndham customer.
The spammers are behind the break in or bought the list from the hackers who broke in.
Security researchers have been looking for years to see who owns certain "open" shared databases on AWS.
Apparently Marriot just stepped forward to claim ownership.
Now that our data is effectively out in the open - there is little to identity us from a trustworthy source. I wonder how banks (et al) are changing to address this. Seriously - if a bank or cellphone company called me to ask where my payment is, I'd ask them to prove "I" opened the account.
My data has been leaked multiple times. Ticketfly, Anthem, Marriott, Experian, and others I can't remember. (plus Amazon leaked my email address -- via a bug in their "forgot password" feature that returned an error message if the account didn't exist, which I reported to them... thank you... still waiting for my $$$).
So what data isn't public? Now that everything is public, nothing is private (If everyone is Super, then no-one is)
Those responsible for sacking the people who have just been sacked have been sacked.
Obviously they have no institutional memory and haven't learned from their past mistakes.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
It's really 500 million RECORDS. That's a big difference... that's still a lot, but the number of different people actually involved in the breach is likely much, much lower.
Also, we keep hearing "going back to 2014" - which means somebody was accessing it back then, not that that represents the oldest information.
I really can't stand the ambiguity/imprecision of these sort of reports.