<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

The Lessons from Marriott’s Epic Data Breach

author Michael Berman
3 min read
Nov 30, 2018

By now you’ve probably heard about the Marriott / Starwood data breach that may have impacted up to 500 million guest records. The information includes name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences for about 327 million guests. Encrypted payment card information was also stolen.

According to the hotel company, an internal security tool alerted it to an unauthorized attempt to gain access to the U.S. Starwood guest reservation database on September 8. Further investigation uncovered unauthorized access to the network since 2014.

The company also discovered that cyber intruders had copied and encrypted information and had tried to delete it. On November 19, 2018, Marriott finally decrypted the information to find out it was information from the Starwood guest reservation database.

A small bit of good news

The good news is that the whole Marriott company wasn’t impacted. Marriott acquired Starwood in late 2015 and Starwood brand hotels (including W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton, Design Hotels, and Starwood branded timeshare programs) and its reservation system is still separate from other Marriott hotels. That limits the breach to just these brands.

But it also makes me wonder about a previous Starwood data breach.

Bad news: This isn’t Starwood’s first data-breach rodeo

This is not the first data breach for Starwood. Before it was acquired by Marriott, it disclosed that malware had been discovered on point-of-sale registers at more than 100 of its hotels and was designed to collect payment information. The breach is believed to have begun around November 2014 and wasn’t fully resolved until April or May of 2015. At the time Starwood said it had “no indication that our guest reservation or Starwood Preferred Guest membership systems were impacted.”

This is concerning. The current breach seems to identify access going back to 2014. Even if these are two totally unrelated breaches, shouldn’t this breach have become apparent in the investigation of the first breach?

Imagine if this happened at a financial institution. There’d be potential for some serious enforcement actions or fines.

More bad news: EU privacy law violations

And in fact, there is the potential for fines. Since Starwood is an international brand, it’s likely some of those 500 million customers are citizens of the European Union where the General Data Protection Regulation (GDPR) gives citizens some of the strongest privacy protections in the world.

Implemented this past May, GDPR protects any information that links to an individual, including names, email addresses, IP addresses, photos, social networking sites in addition to what Americans consider sensitive customer data. Breaches must be disclosed within 72 hours.

Fines can be huge: up to four percent of gross revenues for the most egregious violations, including insufficient customer consent to process, and two percent of gross revenues for violations like not having records in order or failing to promptly notify customers and authorities of a breach.

Marriott clearly breached sensitive data and it appears to have taken more than 72 hours to disclose it. This may prove to be a very expensive breach. That’s on top of the cost of setting up a dedicated call center and providing customers with a personal information monitoring service.

At least it has cyber insurance, according to a report from TechCrunch.

Lessons learned: Cyber breaches cost more than cybersecurity

This breach is a valuable lesson for financial institutions and a good case study for risk managers, IT security professionals, and others trying to make a case for increasing the cybersecurity budget and improve risk management.

The cost of a breach can be incredibly high, not just in dollars and cents but also in reputation damage. I wonder what, if anything, could have been done to detect this breach back in 2014. If Starwood had just a little more thorough risk management or spend just a little more money on another tool, could it have prevented this whole fiasco? After all, someone was supposed to be looking at the whole system in light of the other breach.

Make sure your institution has completed the FFIEC Cyber Assessment Tool to uncover strengths and weaknesses in its cybersecurity efforts. Not only will you know where improvements are needed, you’ll also know the areas where you’ve already spent enough so you don’t overspend.

A cyber breach can have dire consequences for the safety and soundness of your institution. Make sure you’re doing your due diligence to understand and protect against this risk.

 

Related: Creating Reliable Risk Assessments

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Cybersecurity 101: How to Get Senior Management to Spend More on Cybersecurity
Risk Management

Cybersecurity 101: How to Get Senior Management to Spend More on Cybersecurity

Nov 1, 2018 2 min read
The Top 8 Internal Cybersecurity Vulnerabilities Challenging Financial Institutions
Risk Management

The Top 8 Internal Cybersecurity Vulnerabilities Challenging Financial Institutions

Jan 16, 2019 2 min read
How to Control the Financial Risk of a Data Breach
Risk Management

How to Control the Financial Risk of a Data Breach

Dec 5, 2019 3 min read