Data stolen from 500 million Marriot guests 🕵️

Last Friday, hotel chain Marriot revealed that a large-scale cyberattack had led to the theft of personal data belonging to 500 million customers. This was one of the biggest hacks ever, and the hotel company is reportedly already addressing it.

The stolen data includes guests' names, email addresses and phone numbers, addresses, passport numbers, preferences, account details, dates of birth, gender, arrival and departure information, booking dates and communication preferences.

Marriot confirmed that payment details, bank card numbers and expiry dates had also been accessed for some guests. Although credit card numbers were encrypted using an algorithm known as Advanced Encryption Standard (AES-128), with two components needed to decrypt the payment data, the company said it could not rule out the possibility that hackers had stolen both.

The authorities were alerted as soon as the theft from the Starwood booking system was discovered, as this data is a goldmine for identity thieves or government surveillance operations.

Legal trouble around the world

For those who follow digital security at Marriot and Starwood, this attack came as no surprise. The security breach apparently dates back four years, and the hotel chain has been attacked before. Although it did not report any problem, there was an infection within its own incident response team.

Around the world, the hack is already stirring up legal trouble, including at the office of the New York Attorney General, which has asked for answers. In Europe, regulators can impose heavy fines on companies under the General Data Protection Regulation (GDPR), and they are already watching this incident closely.

In the United States, Senator Ron Wyden has said that American regulators need more power to fine companies that fail to protect citizens' data. "Clearly, the current system is not working. The Federal Trade Commission needs real power to punish companies that lose or misuse Americans' private information. Until companies like Marriot face the threat of multi-trillion-dollar fines, and prison for senior executives, these companies will not take privacy seriously," he said.

Unreported attacks

In June last year, Marriot's security team was attacked. The hack was detected and reported by private cybersecurity researchers, as a tweet at the time revealed.

According to a source close to the matter who spoke to Forbes, the incident happened because of a mistake by an outsourced cybersecurity provider whose very job was to protect the hotel giant.

The same source identified the provider as SecureWorks, a company formerly owned by Dell. It declined to comment, while Marriot declined a request to name the supplier that had put millions of people's privacy and security at risk.

However, the hotel chain's account differed from the source's. A Marriot spokesperson told Forbes that the breach stemmed from a contracted analyst downloading a malware sample. The malicious software then gained access to the internal email system. "The breach was an isolated incident involving an analyst's computer, which had web access to Marriot's Outlook and was not connected to Marriot's wider network," the spokesperson explained.

Daniel Gallagher, an independent researcher in this field, disclosed the security breach in 2017. He told the same publication that he discovered the attack after finding a server where Nigerian hackers were running a criminal operation.

Marriot was reportedly one of many victims, Gallagher said, and responded quickly to the problem.

Botnets find rooms at a hotel

Starwood has been plagued by security nightmares both before and after Marriot acquired it in 2016, according to Alex Holden, founder of Hold Security. Holden has been finding vulnerabilities at major companies and shared screenshots showing hackers accessing Starwood's corporate portals.

The images showed a control panel used by Russian criminals to run a network of compromised servers, known as botnets. Six of those servers hosted various starwoodhotels.com domains.

"This particular botnet is part of a very large network of botnets operated by Russian hackers. This interface controls around 1,200 infected devices, which is a tiny drop in the ocean. Many of these drops contain around 10,000 compromised systems. The botnet is stealing tens of gigabytes of information from the compromised systems, including vital files and screenshots," says Holden.

It is currently known that these attackers have access to infected computers, allowing them to reach Starwood resources and employee data. But Holden goes further, saying that passwords for the company's cloud service, ServiceNow, were easy to discover.

That portal provides access to financial records, IT security controls and booking information. Back in 2014, the year Marriot said Starwood's network was hacked, experts warned of a serious vulnerability on the company's website. Known as an SQL injection bug, it may have been exploited to gain access to databases.

These vulnerabilities, and even job offers to attack Starwood, were being shared among hackers on the dark web that year. Around the same time, the company's point-of-sale system was also hacked, but more than a year passed before the company revealed what had happened.

Marriot pays for new passports

Marriot has not yet explained the details of how the database was stolen. The original attack took place in 2014, but the month or date has not been disclosed.

Responding to Holden's allegations, the Marriot spokesperson told Forbes: "We cannot comment on anything that happened on Starwood's network before September 2016, when we completed the acquisition."

This is the kind of threat most retailers, restaurants and hospitality businesses face every day. Many of these problems are beyond their control, as they happen outside internal networks. Alongside regulatory scrutiny, Marriot is already facing large-scale legal action as a result of the security breach.

Meanwhile, the hotel company has said it will cover the cost of new passports for all guests whose data was stolen. In the United States of America, this costs around €110.