Marriott International, Inc. (NASDAQ: MAR), the world’s largest hotel chain, revealed that it had detected a significant data breach in its Starwood reservation system that could have exposed private data of up to 500 million guests. Following the news, the stock lost 5.59% to close at $115.03 on Friday. The group has 6,700 properties in over 129 countries.
A security breach spanning four years
Marriott said that a tool taking care of internal safety measures alerted it of a likely breach to its US database on September the 8th. On November the 19th, digital forensics specialists exposed the full scale of the assault. It was the second main security breach Starwood has detailed after their cash register frameworks were compromised in 2015.
Starwood, which Marriott bought in 2016 for $13.6 billion, did not realize there was an infringement for four years. It was discovered in early September when Marriott officials were cautioned by a security tool to an unauthorized effort to access the Starwood visitor reservation database. The warning prompted Marriott to hire external security professionals who found that hackers had gained access to Starwood’s frameworks and had been active since 2014, which puts the timeframe to before the purchase of Starwood by Marriott.
The system database included information about guests who booked on or before September the 10th. Properties include hotels in Sheraton, Westin, W, St. Regis, Four Points, Aloft, Le Méridien, Tribute, Hotel Design, Collection of Elements, and Luxury. Hotels in Marriott, along with Residence Inn and Ritz-Carlton, are functioning on a distinct booking system. The company intends to bring this system together with Starwood’s.
The company discovered that an unauthorized group had copied and encrypted data from the system, and had tried to steal it. However, it wasn’t until November the 19th that Marriott was able to decode the data to uncover what the details of the breach were.
Marriott has estimated that the data pertaining to 327 million people have been exposed in the breach. The hacked details include guests’ names, phone numbers, email addresses, dates of birth, passport numbers, and travel details. Furthermore, Marriott has also found that credit card numbers and card expiration dates of several million guests were compromised.
Marriott, however, clarified that payment-card numbers are usually encrypted. Still, it does not rule out the possibility of theft of card information as the company is unable to confirm whether the hackers were able to decrypt the credit card numbers.
Commenting on the breach, Marriott Chief Executive Arne Sorenson said: “We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”
As the hack involves customers in the European Union and the United Kingdom, the company may be in violation of the recently embraced Privacy Regulation. The hotel chain said it had informed the breach of their security system to law enforcement. Marriott said it will begin emailing the clients affected by the violation and has set up an informative website, as well as a call center which has been established. The website had issues staying online soon after the revelation of the attack.
The company declared that it offers its visitors a complimentary membership of WebWatcher, a personal data monitoring service. Clients are also requested to monitor their loyalty accounts for suspicious activity, change their account passwords, and verify credit card statements for unauthorized transactions. Mark Thompson, the global leader in consulting firm KPMG’s Privacy Advisory Practice, said the company could be facing significant GDPR penalties.
Thompson said “The size and scale of this thing is huge,” adding that it will take several months for regulators to investigate the infringement. He further stated there is a possibility of class action lawsuits in these cases.
In the United States, the New York Attorney General (AG) office announced that it had started a data breach investigation. The office has also revealed that the company is yet to inform the AG about the data breach as is required by state law.
Maryland and Pennsylvania’s Attorney’s General also announced they were investigating the breach. The disclosure of today marks one of the most significant data breaches in history. In 2017, Yahoo disclosed that 3 billion accounts covering several of its brands were compromised. In 2016, AdultFriendFinder announced that 412 million accounts had been hacked. The current infringement could turn out to be costly for Marriott.
In 2016, Verizon cut Yahoo’s payments by $350 million from the amount it agreed to pay for acquisition after the search engine reported its breach. And in 2017, Equifax had to shell out $400 million in recovery costs, following the hack that affected 148 million people.
On Friday, multiple lawsuits were filed against Marriott, and investigations were opened by Barbara Underwood, the Attorney General of New York, and European regulators.
In Europe, where firms can be fined up to 4% of global revenue under data safety laws, firms must advise government authorities of a known breach within 72 hours. The stock is expected to remain bearish due to the disclosure of a data breach.
The price chart indicates that the stock has broken its 50-day moving average. Furthermore, the stochastic RSI is in the bearish zone. As a result, we can expect the stock to see further selling in the near-term future.
Disclaimer: Any financial trading analysis offered here is our opinion and is not intended as advice or direction for investors. We cannot guarantee the success of any trades made as a consequence of this article, and we encourage traders to incorporate a strong money management strategy to limit losses when they enter the markets. Please use this article as part of your own research before formulating strategies prior to trading.
