Cyber Insurance: ICO Hits Marriott Hotels with £18m Fine

The ICO has fined Marriott International Inc £18.4million for failing to keep millions of customers’ personal data secure.

Marriott estimates that 339 million guest records worldwide were affected following a cyber-attack in 2014 on Starwood Hotels and Resorts Worldwide Inc. The attack, from an unknown source, remained undetected until September 2018, by which time the company had been acquired by Marriott.

The personal data involved differed between individuals but may have included names, email addresses, phone numbers, unencrypted passport numbers, arrival/departure information, guests’ VIP status and loyalty programme membership number.

The precise number of people affected is unclear as there may have been multiple records for an individual guest. Seven million guest records related to people in the UK.

The ICO’s investigation found that there were failures by Marriott to put appropriate technical or organisational measures in place to protect the personal data being processed on its systems, as required by the General Data Protection Regulation (GDPR).

Details of the cyber attack

In 2014, an unknown attacker installed a piece of code known as a `web shell’ onto a device in the Starwood system giving them the ability to access and edit the contents of this device remotely.

This access was exploited in order to install malware, enabling the attacker to have remote access to the system as a privileged user. As a result, the attacker would have had unrestricted access to the relevant device, and other devices on the network to which that account would have had access.

Further tools were installed by the attacker to gather login credentials for additional users within the Starwood network. With these credentials, the database storing reservation data for Starwood customers was accessed and exported by the attacker.

The ICO acknowledges that Marriott acted promptly to contact customers and the ICO. It also acted quickly to mitigate the risk of damage suffered by customers, and has since instigated a number of measures to improve the security of its systems.

Kate Bevan, Which? Computing editor, said:

“It’s positive to see the Information Commissioner’s Office showing its teeth and sending a clear message to companies that it is unacceptable to play fast and loose with people’s personal data. However, our research earlier this year suggested that Marriott had not learned lessons from previous data breaches and still had serious vulnerabilities on its websites that could leave customers exposed to opportunistic cybercriminals.

“Some people will be frustrated if they’ve suffered financially and emotionally from this data breach but had no redress. The government should provide a much clearer route to this by allowing for an opt-out collective redress regime that deals with mass data breaches.

“Any consumers worried that they could have been affected by a data breach should change online passwords that might have been compromised and, where possible, enable two-factor authentication. They should also monitor bank and other online accounts as well as their credit report to guard against potential identity fraud.”