MalwareHospitalityTechnologyHospitalityRansomwareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryMulti-Stage ChainIdentity (basic)Government IDFinancial accountPIICriticalContained

MARRIOTT INTERNATIONAL, INC.

bd_fff14eeff9d1efcf · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 8, 2018

Filed

Dec 3, 2018

To disclose

12 weeks

Affected

500,000,000scope not determined

Linked

4 filings

Confidence

64%

Full breach record for MARRIOTT INTERNATIONAL, INC. →9 incidents on file

Marriott International disclosed a security incident involving the Starwood guest reservation database. Unauthorized access occurred starting in 2014. On Sept 8, 2018, an alert was received. The attacker copied and encrypted data. Up to 500 million guests affected; 327 million had PII including names, addresses, passport numbers, and some had encrypted payment card data. Notification began Nov 30, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1711 days

discovery → filing · 12 weeks / 86 days

Jan 1, 2014

Begins

Sep 8, 2018

Discovered

Dec 3, 2018

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_41ce13df784b7b672018-11-30 · +3dVerified
Montana State AGbd_70a4494ea3883d8f2018-11-30 · +3dVerified
Oregon State AGbd_8a9e56980902ec7b2018-11-30 · +3dCandidate

Name: MARRIOTT INTERNATIONAL, INC.
norm: marriott international
Domain: marriott.com

Name: MARRIOTT INTERNATIONAL, INC.
norm: marriott international
Domain: marriott.com
Industry: HospitalityllmTechnologyllm

Discovered: Sep 8, 2018
Breach occurred: Jan 1, 2014 – Sep 8, 2018
Undetected for: 1,711 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 30, 2018
Affected individuals: 500,000,000scope not determined
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported this incident to law enforcementNotifying regulatory authorities

During the incident: Engaged leading security experts to help determine what occurred
Reported this incident to law enforcement
Notifying regulatory authorities
Established a dedicated call center
Began sending emails on a rolling basis on November 30, 2018 to affected guests
Providing guests the opportunity to enroll in WebWatcher free of charge for one year
Changes made: Phasing out Starwood systems
Accelerating the ongoing security enhancements to our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGNov 30 · first

Montana State AGNov 30 · first

Oregon State AGNov 30 · first

South Carolina State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/Marriott.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 3, 2018
Raw hash: e19a1d9ba4868d110c091e80ff5f4cdccea9ef9f1e7c3065bee2a8d4988c1c6e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMARRIOTT INTERNATIONAL, INC.

Victim entityMARRIOTT INTERNATIONAL, INC.

Incidentdiscovered Sep 8, 2018

Stated responseEngaged leading security experts to help determine what occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov