Slashdot Mirror
Marriott Says Hackers Stole More Than 5 Million Passport Numbers (cnet.com)
Marriott has downsized its original estimate on a major data breach, but the number of people affected is still historic. The hotel group announced Friday that it now believes hackers accessed the records of up to 383 million guests, following an investigation it conducted with a forensics and analytics team. In November, it had reported an estimate of as many as 500 million guests. From a report: Even at that lower figure, the Marriott incident remains one of the largest personal data breaches in history, more than double that of Equifax, which exposed the personal data of 147.7 million American. Data breaches have become a common issue for massive companies that collect and store information on millions of people. In 2018, tech giants like Facebook and Reddit have fallen victim to data breaches. Hackers look for poor protection that they can bypass to steal valuable details like Social Security numbers, birth dates, email addresses and credit card numbers.
A hacker tricked the reservation computer into thinking they were uber-platinum-elite guests, and the hotel concierge put the data on a gold-encrusted USB stick in their welcome bag.
They deserve it.
...All Hackers, Virus creators. etc.
Why is it no resources are ever expended on finding these people and instead spent on an ever expanding effort to block them?
"You steal shit, and we will come for you" should be the motto of law enforcement. Not, "Steal shit and I'll buy newer locks".
When did hotels become customs and immigration officers? Why are you recording the information from my drivers license and passport? Why do you need my email address and mobile phone number?????? Why do you need the registration information of my rental car??????
no fines, no one jailed, nothing. business will continue as usual
It's as if PCI compliance does not exist. Well it doesn't, no one gets in trouble for shit.
Fuck PCI compliance with a big rubber dick.
Why does a hotel chain store passport numbers of its guests? Even if they legitimately do need the information for some reason, shouldn't it be deleted after a short period of time?
Do it!
These massive hacks are happening at an increasing rate.
We need to make an example of them.
Side note, why in God's name does Marriott need to store people's passport info?
In the US, a lawsuit is, minimum, $100K.
I don't respond to AC's.
Their investigation consisted of select count(*) where created < ${discovery_date}
If the law requires you to collect data that you don't need for business purposes, don't store it on a connected computer.
Scan the passport with a non-networked scanner but store the image on the scanner itself or offline for as long as the law requires, then delete it.
Make sure that the scans are encrypted and that they can only be decrypted with a key held off-site by corporate security. That way a clerk can't bulk-copy the scans that are stored on-site.
There is still one hole that can't be fixed: Any clerk that handles a particular passport can make a surreptitious copy for his own use using his own camera. If he has a photographic memory, he can just memorize it. The damage from this method is a lot less than a bulk-data-compromise.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Who gives their passport to a hotel? Hell no. They want a credit card, ok sure. They want my DL#...only if I have to. If they want my passport or SSN they can fuck right off. ABBs in the area will get my business before I give a hotel my international travel documents or my retirement policy number.
Blockchain justification for sure.
Of course it is a step too far at the moment as any single id or number does not have much authenticity if a third party reads it directly rather than using a public private key back to the issuer so how could they jump to a blockchain?
It is frustrating but really why do they care so much about it?
Marriott GAVE away their customers info by not properly securing the data.
That is criminal negligence and occurred prior to the bad hackerz.
The U.K. government has plans that you need to supply a passport number soon to watch porn. What an opportunity: 5 million passport numbers that you can sell one each to five million privacy-conscious Brits who donâ(TM)t want their porn habits leaked.
OPM, Equifax, Marriott... Our Lack of privacy to benefit business is going to come back to bite us if we get in a war with China.
“When it comes time to hang the capitalists, they will vie with each other for the rope contract.”
—Major George Racey Jordan.
Maybe the Alibaba credit system could be hacked.
Suing Marriott will hurt the present stock owners. Need to put a few executives who approved and supervised the data centers, even if they have resigned from the company, in jail. Only then they will take security seriously. As it stands now, they cash in and leave before the shit hits the fan making bag holders out of shareholders.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The Marriott family are Mormons, and as such, I won't ever give them a dime of my money. From what I understand, they are heavy donors to the LDS. No thank you.
Stop storing my damn information.
Marriot also owns Doubletree -- recently a Black man was ejected from a Doubletree in Portland for not interrupting a phone call with his family to "prove" that he was a guest there. Never mind that he showed his room key to the hotel's rent-a-cop, apparently that wasn't enough.
It's sad that we're 170 years out from the Civil War and black people are still treated like animals. It's better up in the the NE, but here in the south, it's still a real thing. Texas here, and an anecdote. I was at a gun store looking at some new pieces. A well-dressed black man came in and the stiffness of the store guys was palpable. They acted almost as if he was a criminal. He asked to see a couple of pistols and they basically acted as if he wanted one only because he had ulterior motives. I would have loved to get that man's take on what he felt. He left without buying. I have never gone back there.
Track Down and Kill All Hackers, Virus creators. etc.
This. A thousand times this. We are at war, and our enemies are winning. Time for those implementing the attacks and wreaking the damage to pay the price all such warmongers should pay (and many, in traditional wars, do), an abrupt, preferably painful end to their tiny pathetic lives.
If hackers feel the fear of death every time they type a command (or click a script-kiddy icon), maybe they'll think twice before going to work for/bending over for Vlad.
https://www.youtube.com/watch?...
For your own protection in mat be better to stay someplace else.
Marriott does not own Doubletree, that is Hilton. The simplest search query would've told you that
Oh... You just threatened the CIA, FSB and basically every single country's security-service ... watch out...
It would be a lot better to go after people gathering, and not protecting, other peoples information. If i where to personal information and keep on paper i would be required to store it in a safe and secure location to prevent unauthorized people to access it... Now they store this same information *unencrypted* (encrypting the data with a key that's also available on related systems is not really protecting it) and connected to the internet for ease of access. ..
If you want to keep a history available, containing personal information, online then encrypt the sensitive data with public key encryption and only store the public key on the server. If you ever need to access the encrypted data you either go to the security-department to have it decrypted.