5.2M Guests Affected by New Marriott Data Breach

In a notice posted on its website, Marriott International announced that approximately 5.2 million guests could be affected by a recent data breach. According to the company, a property system, used by hotels that are operated and franchised under Marriott's brands, was accessed by the compromised login credentials of two employees from a franchise property. The company learned of the data breach at the end of February but believes that the activity started in mid-January. 

Upon discovery, the company disabled the compromised login credentials, immediately began an investigation, implemented heightened monitoring, and arranged resources to inform and assist guests. Marriott also notified relevant authorities and is supporting their investigations.

According to Marriott, Marriott Bonvoy account passwords or PINs, payment card information, passport information, national IDs, or driver’s license numbers were not compromised. Instead, it believes information compromised included:

• contact details (e.g., name, mailing address, email address, and phone number)
• loyalty account information (e.g., account number and points balance, but not passwords)
• additional personal details (e.g., company, gender, and birthday day and month)
• partnerships and affiliations (e.g., linked airline loyalty programs and numbers)
• preferences (e.g., stay/room preferences and language preference)

Marriott carries insurance, including cyber insurance, commensurate with its size and the nature of its operations, and the company is working with its insurers to assess coverage. The company does not currently believe that its total costs related to this incident will be significant.

INDUSTRY EXPERT COMMENTARY

 

On how the criminals gained access to guest information....

"A frequent goal of targeted phishing attacks is credential theft and account takeover, which can be leveraged for attacks," said Chris Hazelton, Director of Security Solutions at Lookout. "While we don’t have all the details yet, it is highly likely that this breach started with a phishing attack which enabled a threat actor to steal the credentials of two employees at a Marriott franchise. Acquiring these credentials gave the cybercriminals nearly unlimited access to Marriott customer records. Luckily this data did not include highly sensitive information, such as passwords or payment information. For this reason, the attack may have targeted a CRM system or other non-financial enterprise app."

"Recent Vectra research shows that privileged access from unknown hosts occurs inside every industry, leading to unintended exposure of critical systems," said Chris Morales, head of security analytics at Vectra. "Yet these privileged accounts rarely receive direct oversight or technical control of how they are used, even when privileged access management tools are in place. It is this lack of oversight or understanding of how privileged accounts are being used that creates the operational and financial risk for organizations. If used improperly, privileged accounts have the power to cause much damage, including data theft, espionage, sabotage, or ransom."

“Lost, stolen, or misused employee credentials leading to data breach is an important conversation we need to be having, because identity and access management and multi-factor authentication are often overlooked technologies," said Sam Pfanstiel, Director of Security Consulting Services, ControlScan. "We have seen privilege abuse and misuse behind a growing number of attacks. While certainly we don’t know all the details surrounding this breach—whether the credentials were stolen through a targeting phishing attack, or if this was an insider threat—we do know that the current way of protecting credentials and user authentication simply isn’t working. A return is in order to strong authentication, principle of least privilege, and active security monitoring to curb this disturbing trend."

On not implementing security basics...

“The essential practices of protecting systems and applications are well known - they are enumerated in the NIST Cybersecurity Framework. Companies can choose to either proactively implement those practices consistently in their systems, or they can choose to be frequently compromised. There is no other alternative," says Kelly White, CEO, RiskRecon. "This breach reflects a lack of doing the basics well, specifically two-factor authentication and user account activity monitoring. Either of these would have either prevented the breach by increasing the difficulty of stealing the credentials or by dramatically decreasing the scope of compromise. One would think that a franchise account looking up 5.2 million customer accounts was anomalous behavior.”

 

On how cyber criminals will use compromised data...

“The biggest threat Marriott guests might face as a result of this breach is targeted phishing," said Paul Bischoff, privacy advocate with Comparitech. "Guests should be on the lookout for targeted messages from scammers posing as Marriott or a related company. Don't click on links or attachments in unsolicited emails. Check email addresses and don't just trust display names. If you're uncertain as to whether a message is legitimate or not, ask Marriott using contact information found through Google.”

“Account takeover (ATO) attacks are a major threat to any business," says Ameet Naik, security evangelist at PerimeterX. "It is much simpler and lucrative to walk in through the front door with valid stolen credentials than to look for holes in an organization's cybersecurity defenses. With the vast volume of stolen credentials out there, hackers launch credential stuffing attacks using automated bots. Eventually they find a username and password that works that will let them buy goods for resale, drain loyalty accounts of points or steal personal information. The data stolen from this breach will invariably make it to the dark web and further fuel this cycle of ATO attacks. 

“In the past month we have seen a significant increase in the percentage of ATO traffic to travel and hospitality sites, surging to as high as 80% of all login attempts. This shows that while travelers are staying home, the hackers are still out and about," Naik adds. "For enterprises, it is extremely important to use multi-factor authentication for admin accounts, and use bot management solutions to limit automated attacks. For consumers, it is best to use different passwords on every site and to lock down their credit reports."

On what Marriott can do to make it up to consumers...