Fewer affected in Marriott hack, but passports a red flag

January 4, 2019
Fewer affected in Marriott hack, but passports a red flag
This Oct. 5, 2010 file photo shows the exterior of a Marriott hotel in Santa Clara, Calif. Marriott says that fewer guest records were involved in a previously announced data breach than it initially disclosed. The lodging company said Friday, Jan. 4, 2019, that it now believes that the number of potentially involved guests is lower than the 500 million originally estimated. (AP Photo/Paul Sakuma, File)

Fewer Marriott guest records than previously feared were compromised in a massive data breach, but the largest hotel chain in the world confirmed Friday that approximately 5.25 million unencrypted passport numbers were accessed.

The compromise of those passport numbers has raised alarms among security experts because of their value to state intelligence agencies.

The FBI is leading the investigation of the data theft and investigators suspect the hackers were working on behalf of the Chinese Ministry of State Security, the rough equivalent of the CIA.

The hackers accessed about 20.3 million encrypted passport numbers. There is no evidence that they were able to use the master encryption key required to gain access to that data.

Unencrypted passport numbers are valuable to state intelligence agencies because they can be used to compile detailed dossiers on people and their international movements.

In the case of China, it would allow that country's security ministry to add to databases of aggregated information on valued individuals. Those data points include information on people's health, finances and travel.

"You can identify things in their past that maybe they don't want known, points of weakness, blackmail, that type of thing," said Priscilla Moriuchi, an analyst with Recorded Future who specialized in East Asia at the U.S. National Security Agency where she spent 12 years. She left the agency in 2017.

When the Bethesda, Maryland, hotel chain initially disclosed the breach in November, the company said that hackers compiled stolen data undetected for four years, including credit card and passport numbers, birthdates, phone numbers and hotel arrival and departure dates.

The affected hotel brands were operated by Starwood before it was acquired by Marriott in 2016. They include W Hotels, St. Regis, Sheraton, Westin, Element, Aloft, The Luxury Collection, Le Méridien and Four Points. Starwood-branded timeshare properties were also affected. None of the Marriott-branded chains were threatened.

Marriott said Friday that it now believes the overall number of guests potentially involved is around 383 million, less than the initial estimate of 500 million, but still one of the largest security breaches on record.

The 2017 Equifax hack affected more than 145 million people. A Target breach in 2013 affected more than 41 million payment card accounts and exposed contact information for more than 60 million customers.

Explore further: Marriott security breach exposed data of up to 500M guests (Update)

Related Stories

So you stayed at a Starwood hotel: Tips on data breach

November 30, 2018

If you stayed at one of Marriott's Starwood hotels in recent years, hackers might have information on your address, credit card and even your passport. Some of this can be used for identity theft, as hackers create bank and ...

The Marriott breach compared with past security breakdowns

November 30, 2018

Marriott's revelation that as many as 500 million guests may have been affected by a data breach at Starwood hotels, which it bought two years ago, ranks among the largest hacks ever. It is not clear if some of those included ...

Recommended for you

Archaeologists discover Incan tomb in Peru

February 16, 2019

Peruvian archaeologists discovered an Incan tomb in the north of the country where an elite member of the pre-Columbian empire was buried, one of the investigators announced Friday.

Where is the universe hiding its missing mass?

February 15, 2019

Astronomers have spent decades looking for something that sounds like it would be hard to miss: about a third of the "normal" matter in the Universe. New results from NASA's Chandra X-ray Observatory may have helped them ...

What rising seas mean for local economies

February 15, 2019

Impacts from climate change are not always easy to see. But for many local businesses in coastal communities across the United States, the evidence is right outside their doors—or in their parking lots.

The friendly extortioner takes it all

February 15, 2019

Cooperating with other people makes many things easier. However, competition is also a characteristic aspect of our society. In their struggle for contracts and positions, people have to be more successful than their competitors ...

0 comments

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.