sb-as logo
Story image

Marriott International reports breach affecting 5.2 million customers

Marriott International, the hospitality company that operates and manages hotels across the world, yesterday revealed it had fallen victim to coordinated and wide-reaching cyber attack, potentially putting at risk 5.2 million hotel guests’ personal information.

Marriott said in statement that an ‘unexpected’ amount of guest information may have been accessed in mid-January this year, using the login credentials of two employees at one of the company’s franchise properties.

The attack was carried out via third-party software that Marriott hotel properties use to provide guest services.

The company says contact details, loyalty account information, partnerships and affiliation details, and preferences such as room and language preferences ‘may have been involved’ in the attack, affecting 5.2 million people who had stayed in Marriott properties in the past.

Marriott says the company had no reason to believe that the vulnerable information also included more sensitive data, like payment card information, account passwords or passport data.

In response, the company says it is in the process of emailing potentially affected customers with advice on the next steps to take but believes that the total costs related to this incident would not be significant.

This represents the second large data breach that the company has faced in the last two years, generating concern about Marriott’s cyber security hygiene.

"A global company like Marriott, which holds a massive amount of personal information about its guests, will always be an attractive target for bad actors,” says LogRhythm Labs senior director Andrew Hollister.

“Whilst this is the second data breach Marriott has reported in the last two years, there are some positives to draw from the statement released today.

“In the previous incident in 2018, Marriott detected signs of unauthorised activity going back four years. 

“In this new case, the activity appears to have begun in January 2020 and been detected during the course of February 2020. This is a significant improvement in time to detect and respond to a data breach,” says Hollister.

“Whilst a significant number of records has been breached, the reduced time to detect has no doubt contributed to the number being substantially lower than on the previous occasion.”

Cybersecurity company Sophos says the breach is potentially one of many large-scale attacks which may happen as a result of the worldwide trends of security systems being rendered vulnerable as a result of the COVID-19 pandemic. 

“[This breach] highlights the fact that, even during a global pandemic, criminals will not stop attacking us,” says Sophos senior security advisor John Shier.

“Even though no passwords, PINs, identity documents, or financial information was reportedly stolen, enough personal information was compromised that can be of use to identity thieves. 

“This information can be used to lend credibility to phishing emails and increase their chance of success,” says Shier.

“Let's not give cyber criminals an easy win during these unprecedented times stay vigilant against their dirty tricks. They won't rest, neither should we."

Story image
Businesses left to make decisions based on old, inaccurate data, study finds
"It is more critical than ever that organisations have access to actionable, contextualised, near real-time threat data to power the network and application security tools they use to detect and block malicious actors."More
Story image
Why zero trust could fail due to lack of understanding​, not technology
Security architects are being forced to re-examine the concept of identity, with many turning to a zero trust security model to provide a better architecture for protecting their sensitive resources.More
Story image
Gartner reveals the top strategic tech trends for 2021
“CIOs are striving to adapt to changing conditions to compose the future business - this requires the organisational plasticity to form and reform dynamically. Gartner’s top strategic technology trends for 2021 enable that plasticity.”More
Story image
BlueVoyant acquires Managed Sentinel, builds out Microsoft MSS offerings
“Combining Managed Sentinel’s Azure Sentinel deployment expertise with BlueVoyant’s MDR capabilities will help customers operationalise and maximise Microsoft security technologies."More
Story image
The three-pronged security approach that confronts security breaches head-on
Having these three processes working in tandem is key to cushioning the blow of a breach - which, if insufficiently protected, can take on average 279 days to contain and costs an average of almost US$4 million.More
Story image
Microsoft takes legal action to disrupt botnet and combat ransomware
Microsoft has announced it took action to disrupt a botnet, Trickbot, one of the world's most infamous botnets and prolific distributors of malware and ransomware.More