Marriott International becomes the hackers’ latest victim

DATA BREACHES have become so common that even biggish ones no longer make the news. But on November 30th Marriott International, a big American hotel chain, announced a real whopper. Half a billion records from a database owned by Starwood, one of the firm’s subsidiaries, had been accessed by hackers.

The firm does not know exactly what was taken. But it thinks that, for about 327m guests, the exposed information includes some combination of names, addresses, dates of birth, passport numbers and more. Some people in that subset—it has not said how many—may also have had credit-card details stolen. Those credit-card details were encrypted, which should have made it impossible for the attackers to use them. But Marriott says that it cannot rule out the possibility that the secret keys needed to decrypt them were also taken (storing encryption keys near the data they protect is a bad idea, for exactly this reason).

Ranked purely by the number of people affected, the attack is one of the biggest ever. Yahoo, a big internet firm, suffered a data breach in 2013 that affected all 3bn of its user accounts. AdultFriendFinder, a sex website, had 412m records swiped in 2016. But in both cases, the number of real people affected was smaller. Such websites are full of duplicate accounts, many of which are rarely or never used and are registered under false names.

A hotel’s guest database is a different matter. A better comparison with the Marriott breach is the hack of Equifax, a credit-scoring agency, in 2017. Although “only” 143m records were breached in the Equifax case, they contained sensitive data such as credit-card details and social-security numbers (a unique identifier used by the American government). Equifax has been sued repeatedly as a result of its breach; its boss at the time was forced to step down; and its share price, which fell by 14% on the news, took months to recover.

As this article was being written, shares in Marriott International had fallen 5%. Marriott has said that it has reported the incident to the police, and is beginning the process of notifying affected customers. The firm will be hoping that a relatively swift response will mollify regulators, customers and investors. But as the circumstances of this breach are examined, the fall-out may yet turn out to be severe.

The endless stream of data-leaks has led governments and regulators to toughen the rules. In May, for instance, the European Union brought in the General Data Protection Regulation (gdpr), which imposes fines of up to 4% of global turnover on firms found to have been lax about protecting their customers’ data. Marriott admitted that, although the first alert generated by its security software came on September 8th, the hackers appear to have had access to its systems since 2014. Combined with the firm’s apparent carelessness with encryption keys, regulators will surely be asking awkward questions about just how competent its security was.