In 2018, Marriott International, one of the world’s largest hotel chains, disclosed a significant data breach that compromised the personal information of millions of its guests. The breach, which lasted for several years, highlighted the vulnerabilities in the hospitality industry’s cybersecurity measures.
1. Breach Overview and Impact
a. Timeline: The breach occurred between 2014 and September 2018 but was discovered and disclosed in November 2018. It affected the Starwood guest reservation database, which was acquired by Marriott in 2016.
b. Scope of Impact: The breach exposed personal information, including names, addresses, passport numbers, payment card details, and other sensitive data, of approximately 383 million guests.
c. TTPs (MITRE ATT&CK): Specific TTPs associated with the Marriott data breach are not available.
2. Response and Fallout
Marriott faced criticism for its slow detection and disclosure of the breach, as well as its failure to fully encrypt some payment card details. The incident resulted in regulatory investigations, lawsuits, and potential financial penalties.
The company provided support and assistance to affected guests, including offering credit monitoring services and taking steps to enhance its cybersecurity measures. Marriott also accelerated its efforts to merge its reservation systems and improve data security practices across its properties.
3. Lessons Learned
The Marriott data breach highlighted the critical need for organizations in the hospitality industry to prioritize cybersecurity and protect guest data effectively. It emphasized the importance of robust encryption, continuous monitoring, and timely incident response to mitigate the impact of breaches. The incident also underscored the significance of transparency and prompt disclosure to maintain customer trust.
Further Reading:
https://www.bbc.co.uk/news/technology-54748843