Marriott Starwood hotel data breach FAQ: What 500 million hacked guests need to know
It’s been a couple of months since a major company unveiled a data breach that affected millions of people, so it’s time for a new one. The Marriot hotel chain has announced a major database breach that could affect anyone who stayed at its 6,700 worldwide Starwood hotel properties since 2014 – up to 500 million people in total.
That’s a lot of people an a long stretch of time, so here is our FAQ:
What happened?
Marriott says it received an alert from an internal security tool on 8 September warning of an attempt to access the Starwood guest reservation database in the United States. In its investigation of the incident, Marriott learned that an unauthorised party gained access to the company’s customer database and “copied and encrypted information, and took steps toward removing it”.
How did the hackers get in?
Marriott isn’t being totally clear here, but it appears as though this wasn’t the usual exploit of a vulnerability. Rather, someone without the proper credentials was able to access the Marriott reservation database to make a duplicate encrypted copy of customer information, which was then presumably taken outside the system.
How far back does the breach go?
Marriott says the unauthorized access goes back to 2014.
Why wasn’t Marriott alerted sooner?
Also unclear, but perhaps the unauthorised party only recently started accessing the system. Or possibly Marriott recently installed new security software that was able to detect the access.
Why are we just hearing about now?
Marriott says it was only able to decrypt the files on 19 November and is still working to uncover the scope of the breach.
What was stolen?
Marriott is still sorting through the data it was able to recover, but for most customers, the following data may have been stolen: name, mailing address, phone number, e-mail address, passport number, Starwood Preferred Guest (SPG) account information, date of birth, gender, and arrival and departure information, along with reservation dates and communication preferences.
Should I change my password?
Marriott hasn’t said whether any accounts were accessed or passwords stolen, but it certainly can’t hurt. But this was a breach of the company’s internal database of hotel guests, not online accounts.
Password managers make it easy to create strong, unique passwords for every site you visit. If you aren’t using one yet, we recommend doing so.
What about credit card information?
For some users, Marriott says payment card numbers and payment card expiration dates were included in the stolen data, but card numbers were encrypted using Advanced Encryption Standard encryption (AES-128).
So my credit card is safe?
Possibly not. As Marriott explains: “There are two components needed to decrypt the payment card numbers, and at this point, Marriott has not been able to rule out the possibility that both were taken.”
What about my SPG points?
Marriott says there is no evidence that any loyalty points were obtained, but you should check your account for any suspicious activity.
Has the breach been stopped?
Presumably, but Marriott doesn’t explicitly say whether the unauthorised access has been shut down. However, the chain is working with law enforcement agencies and regulatory authorities, so the likelihood of a continued breach is extremely low.
What is Marriott doing to stop future breaches?
Again, it’s not totally clear if the hacker exploited a vulnerability or merely used an unauthorised password, but Marriott says it is devoting the resources necessary to phase out Starwood systems and accelerate the ongoing security enhancements to our network.
How do I know if my data was accessed?
Marriott began sending e-mails on a rolling basis on 30 November to affected guests, so sure to make check you spam folder if you haven’t received one.
What can I do if I was affected?
There is a dedicated page on the website Kroll.com that can tell you more and has the number of a UK a helpline.
Should I cancel my credit card?
Also not a bad idea. If you know the credit card or cards that are on file with Marriott or Starwood hotels, cancelling them now is the best way prevent any future malfeasance.
What else can I do?
Marriott is providing all guests in the US, Canada, the UK with the opportunity to enroll in Kroll’s Web Watcher Monitoring Service, which tracks sites where personal information is shared and alerts you if evidence of your personal information is found.
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers