Half a billion user accounts stolen over four years

On 8^th September 2018, Marriott hotels noticed a security alert concerning an attempt to access the Starwood Hotels reservation database which the hotel chain had purchased back in 2016. Recent investigations have revealed that the attackers had access to the Starwood systems and database since 2014, resulting in some 500 million user accounts being compromised.

This colossal data breach is thought to be the second largest data breach in history, with stolen data including names, addresses, passport numbers and encrypted payment card details.

Marriott states:

“the payment card numbers were encrypted using Advanced Encryption Standard encryption (AES-128). There are two components needed to decrypt the payment card numbers, and at this point, Marriott has not been able to rule out the possibility that both were taken.”

The scale of the breach is already prompting action from US lawmakers, including consideration of GDPR-like regulations that would require data retention policies to be defined and for all unnecessary data to be deleted.  Attackers cannot steal data you do not hold.

It goes without saying that a comprehensive penetration test and security audit during the due-diligence phase of the acquisition of Starwood, or any time since, could have identified the security weaknesses exploited by the hackers.

Intrusion Detection Systems can be effective in identifying unauthorised access to network resources, but they need to be correctly configured and monitored.  The attackers were active in the Starwood network for four years before being detected, systematically extracting data, encrypting it and exfiltrating it from the network.  Many CISO’s today are adopting the attitude implied by standards such as PCI-DSS: do all you can to protect your network but assume you will be breached, so make sure your monitoring is set up to detect it as quickly as possible.

Data Leakage Protection measures need to reflect the sophistication of the attackers and the value of the data to be stolen.  Starwood had a DLP system in place that looked for PAN numbers leaving the network, and so the hackers simply disguised the card data through encryption before exfiltrating it in order to bypass the monitoring systems.