It seems not a week goes by these days without news breaking of another massive data breach affecting hundreds of millions of people. At the end of November 2018, Marriot, the global hotel chain, announced they had been hacked and the personal information of five hundred million preferred customers had been exposed to criminals. What’s worse, Marriott announced the original data breach occurred over four years ago, leaving people unknowingly at risk for identity theft during that time.
The hack actually occurred on the reservation system used by Starwood Hotels back in 2014. Marriot purchased Starwood in 2016. Apparently, Marriott’s due diligence review of the Starwood’s information security architecture failed to discover the breach at that time. The breach is particularly sensitive given that cyber criminals were able to view highly sensitive information such as passport numbers as a result of the breach. This website is available with more details and continues to be updated.
Several agencies have raised the possibility that the Marriott breach was the result of a Chinese intelligence agency. These reports point to the patient nature of the attackers and the fact that the breach took so long to discover. Intelligence agencies could gain key insights into the travel activities of high ranking personnel in both the private and public sector around the world. This remains unconfirmed and the Chinese government denies it.
Regardless of the perpetrators responsible, the breach highlights a number of concerning areas for businesses in the modern world. For one, the increasing cost of these breaches should send shivers down the spine of any business storing the personal information of customers. Analysts have estimated the total price tag for Marriott to respond to the breach adequately might breach one billion dollars. Fines alone might equal $400 million.
It also highlights the increasing need for companies to ensure they are performing air-tight due diligence during mergers and acquisitions. Reviewing a company’s information security, its databases, and all relevant information is necessary to avoid a nasty surprise such as this. Sufficient due diligence in this area could have literally saved Marriott a billion dollars.
Ultimately, though, the increasing prevalence and costs of these breaches foreshadow even more aggressive legislation by governments around the world to try and force companies to keep up to date with their cybersecurity. The European Union enacted its General Data Protection Regulation, more commonly referred to GDPR, recently. Senators in the United States are making noise about pushing a similar measure in the U.S.
These types of hacks and breeches are not going away. They will only increase in frequency and increase in cost. Companies need to be doing everything appropriately within their power to protect their systems. They can’t afford not to.