Security & Fraud

2015 Marriott Breach: Prelude To 2018 Cyberattack?

Marriott International, which announced last week it was the victim of a hack in which the bad guys accessed its reservation database for Starwood properties, could have stopped the breach years earlier.

According to a report in the Wall Street Journal citing cyber security specialists, the breach in which the personal information of as many as 500 million customers was exposed began in 2014, going undetected until September of 2018. In 2015, the Wall Street Journal reported Marriott had a smaller breach in which malware was installed on point of sale systems in hotel restaurants and gift shops. That was announced four days after Marriott announced it was buying Starwood Hotels & Resorts, noted the paper. While Marriott says the 2015 incident wasn’t related to the attack it made public Friday, cybersecurity specialists said a deeper dive into that 2015 incident may have uncovered the hackers, who were able to hang around in the reservation system for at least three years.

“With all the resources they have, they should have been able to isolate hackers back in 2015,” said Andrei Barysevich, a researcher with the security company Recorded Future, in the Wall Street Journal report. A spokeswoman for Marriott said everyone involved would have preferred the incident was identified earlier. “When there is a concern that payment cards are at risk, forensic investigations start looking at devices that process payment cards and follow the evidence from there.”

The hack disclosed last week is second only to Yahoo, which was hacked in 2013 and 2014, with data on 500 million and three billion users exposed. The hack could hurt Marriott’s reputation at a time when it’s fighting off the likes of Airbnb. Marriott said it’s still working through the cause and impact of the hack. It said it learned of it on Sept. 8 and notified customers and regulators shortly after determining on November 19 that hackers accessed information from the Starwood reservation database.  That means hackers may have gotten access to passports, travel details and, in some cases, credit card information on 327 million people.



The How We Shop Report, a PYMNTS collaboration with PayPal, aims to understand how consumers of all ages and incomes are shifting to shopping and paying online in the midst of the COVID-19 pandemic. Our research builds on a series of studies conducted since March, surveying more than 16,000 consumers on how their shopping habits and payments preferences are changing as the crisis continues. This report focuses on our latest survey of 2,163 respondents and examines how their increased appetite for online commerce and digital touchless methods, such as QR codes, contactless cards and digital wallets, is poised to shape the post-pandemic economy.