HackingHospitalityHospitalityData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountPIICriticalContained

MARRIOTT INTERNATIONAL, INC.

bd_41ce13df784b7b67 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 8, 2018

Filed

Nov 30, 2018

To disclose

12 weeks

Affected

500,000,000

Linked

4 filings

Confidence

64%

Full breach record for MARRIOTT INTERNATIONAL, INC. →9 incidents on file

Marriott International disclosed unauthorized access to the Starwood guest reservation database. The intrusion occurred between 2014 and September 10, 2018, but was not detected until September 8, 2018. Approximately 500 million guests were affected. Data exposed included names, addresses, passport numbers, and encrypted payment card details. Marriott engaged forensic experts, contained the incident, and offered monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1711 days

discovery → filing · 12 weeks / 83 days

Jan 1, 2014

Begins

Sep 8, 2018

Discovered

Nov 30, 2018

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_70a4494ea3883d8f2018-11-30Verified
Oregon State AGbd_8a9e56980902ec7b2018-11-30Candidate
South Carolina State AGbd_fff14eeff9d1efcf2018-12-03 · +3dVerified

Name: MARRIOTT INTERNATIONAL, INC.
norm: marriott international
Domain: marriott.com

Name: MARRIOTT INTERNATIONAL, INC.
norm: marriott international
Domain: marriott.com
Industry: Hospitalityllm

Discovered: Sep 8, 2018
Breach occurred: Jan 1, 2014 – Sep 10, 2018
Undetected for: 1,711 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 30, 2018
Affected individuals: 500,000,000nationwide
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Notifying regulatory authorities

During the incident: Engaged leading security experts to help determine what occurred
Moved quickly to contain the incident
Reported this incident to law enforcement
Notifying regulatory authorities
Established a dedicated call center to answer questions
Providing guests the opportunity to enroll in WebWatcher free of charge for one year
Changes made: Devoting the resources necessary to phase out Starwood systems
Accelerate the ongoing security enhancements to our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGNov 30 · first

Oregon State AGNov 30 · first

California State AGNov 30 · first · this page

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-142258
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2018
Raw hash: ff87ebc3c9374d5d0ac8ce8172ea1984370c37f797f0785d83f39523c3d44ef6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMARRIOTT INTERNATIONAL, INC.

Victim entityMARRIOTT INTERNATIONAL, INC.

Incidentdiscovered Sep 8, 2018

Stated responseEngaged leading security experts to help determine what occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov