marriott sign

Marriott Discloses Second Security Breach, Affecting Millions, In Two Years

The hack took place through Marriott Bonvoy, the company's loyalty app, and affected up to 5.2 million guests.

Disclosing its second major security breach in the past two years, the international hotel chain Marriott announced on Tuesday that a hacker had accessed data affecting up to 5.2 million guests who used Marriott Bonvoy, the company’s loyalty app.

Marriott said the hack first began in mid-February but company officials did not become aware until the end of February. A breach notification published on Marriott’s website details how a hacker used login credentials of two employees at a Marriott property to access customer information from the Bonvoy database.

“Upon discovery, we confirmed that the login credentials were disabled, immediately began an investigation, implemented heightened monitoring, and arranged resources to inform and assist guests,” the breach notification reads.

While the company investigation remains ongoing, Marriott has not found evidence that the hacker accessed account passwords, payment card information, passport information, national ID numbers or driver’s license numbers. The exposed information did include the following:

  • Contact details (e.g., name, mailing address, email address, and phone number)
  • Loyalty account information (e.g., account number and points balance, but not passwords)
  • Additional personal details (e.g., company, gender, and birthday day and month)
  • Partnerships and affiliations (e.g., linked airline loyalty programs and numbers)
  • Preferences (e.g., stay/room preferences and language preference)

Not all of this information was entered for each guest, the company said. Guests involved in the breach were notified by Marriott on Tuesday, and the chain has also set up a self-service online portal for guests to identify if their information was involved in the breach. Affected individuals can also see what categories of information were part of the breach.

Paul Bischoff, a privacy advocate with the tech research and consumer website Comparitech, said that the biggest threat facing Marriott customers in the recent breach is “targeted phishing.”

“Guests should be on the lookout for targeted messages from scammers posing as Marriott or a related company,” Bischoff said. “Don't click on links or attachments in unsolicited emails. Check email addresses and don't just trust display names. If you're uncertain as to whether a message is legitimate or not, ask Marriott using contact information found through Google.”

Back in November 2018, Marriott also disclosed that hackers had accessed personal details of an estimated 500 million guests worldwide through the Starwood Hotels reservation system it had acquired. While the company has since lowered the total to 383 million, Marriott has faced penalties in the U.K. for lax cybersecurity practices. Chinese hackers are suspected in that case.

Andrew Hollister, the director of LogRhythm Labs, noted that there are some positives to draw from Marriott’s disclosure on Tuesday, particularly in the company’s response time to the breach.

“In the previous incident in 2018, Marriott detected signs of unauthorized activity going back four years,” Hollister said. “In this new case, the activity appears to have begun in January 2020 and been detected during the course of February 2020. This is a significant improvement in time to detect and respond to a data breach.”

He added: “This latest data breach just goes to show that continuing vigilance is required to keep reducing the time to detect and respond to threats, and that real reductions in impact can be made with focus on this issue which affects every company on the globe which holds personal information.”

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Progressing in Capabilities

    Progressing in Capabilities

    Hazardous areas within industries like oil and gas, manufacturing, agriculture and the like, have long-sought reliable video surveillance cameras and equipment that can operate safely in these harsh and unpredictable environments. Read Now

  • A Comprehensive Nationwide Solution

    A Comprehensive Nationwide Solution

    Across the United States, manufacturing facilities, distribution centers, truck yards, parking lots and car dealerships all have a common concern. They are targets for catalytic converters. In nearly every region, cases of catalytic converter thefts have skyrocketed. Read Now

  • Planning for Your Perimeter

    Planning for Your Perimeter

    The perimeter is an organization’s first line of defense and a critical element of any security and surveillance program. Even if a building’s interior or exterior security is strong, without a solid perimeter surveillance approach any company or business is vulnerable. Read Now

  • The Key Issue

    The Key Issue

    It is February 2014. A woman is getting ready in her room on a cruise ship when she hears a knock on the door; it is a crewmember delivering breakfast. She is not presentable so she tells him to leave it by the door. Read Now

Featured Cybersecurity

New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3

  • VideoEdge 2U High Capacity Network Video Recorder

    VideoEdge 2U High Capacity Network Video Recorder

    Johnson Controls announces a powerful recording solution to meet demanding requirements with its VideoEdge 2U High Capacity Network Video Recorder. This solution combines the powerful capabilities of victor with the intelligence of VideoEdge NVRs, fueled by Tyco Artificial Intelligence, for video management that provides actionable insights to save time, money and lives. 3

  • Dahua 2-Wire IP Video Intercom System

    Dahua 2-Wire IP Video Intercom System

    Dahua Technology is introducing a new line of expandable 2-wire IP video intercom solutions for the North America market. The New 2-wire IP video intercom is more advanced, cost effective, and designed to help businesses increase their security. 3