MalwareHospitalityHospitalityRansomwareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryMulti-Stage ChainIdentity (basic)Government IDFinancial accountPIICriticalContained

MARRIOTT INTERNATIONAL, INC.

bd_70a4494ea3883d8f · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 8, 2018

Filed

Nov 30, 2018

To disclose

12 weeks

Affected

500,000,000scope not determined

Linked

4 filings

Confidence

64%

Full breach record for MARRIOTT INTERNATIONAL, INC. →9 incidents on file

Marriott International disclosed a security incident involving the Starwood guest reservation database. Unauthorized access occurred since 2014. Data encrypted and copied by an unauthorized party. Approximately 500 million guests affected, including names, addresses, passport numbers, and encrypted payment card data. Notifications sent November 30, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1711 days

discovery → filing · 12 weeks / 83 days

Jan 1, 2014

Begins

Sep 8, 2018

Discovered

Nov 30, 2018

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_41ce13df784b7b672018-11-30Verified
Oregon State AGbd_8a9e56980902ec7b2018-11-30Candidate
South Carolina State AGbd_fff14eeff9d1efcf2018-12-03 · +3dVerified

Name: MARRIOTT INTERNATIONAL, INC.
norm: marriott international
Domain: marriott.com

Name: MARRIOTT INTERNATIONAL, INC.
norm: marriott international
Domain: marriott.com
Industry: Hospitalityllm

Discovered: Sep 8, 2018
Breach occurred: Jan 1, 2014 – Sep 10, 2018
Undetected for: 1,711 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 30, 2018
Affected individuals: 500,000,000scope not determined
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Reported this incident to law enforcementNotifying regulatory authorities

During the incident: Engaged leading security experts to help determine what occurred
Took steps towards removing the unauthorized party's access
Reported this incident to law enforcement
Notifying regulatory authorities
Established a dedicated call center
Began sending emails to affected guests
Providing guests the opportunity to enroll in WebWatcher free of charge for one year
Changes made: Phasing out Starwood systems
Accelerating ongoing security enhancements to our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGNov 30 · first

Oregon State AGNov 30 · first

Montana State AGNov 30 · first · this page

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Marriott-International-Starwood.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2018
Raw hash: 41aeb08d185790dcb17c5e63a95a38e446790e0b3aaa3b3b27f239ab436d2441

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMARRIOTT INTERNATIONAL, INC.

Victim entityMARRIOTT INTERNATIONAL, INC.

Incidentdiscovered Sep 8, 2018

Stated responseEngaged leading security experts to help determine what occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov