Potential Swan-Dolphin Data Breach

[TheGuyThatMakesSwords]

For those that have STAYED at Swan-Dolphin over the last few years (2014 to present)...
Swan-Dolphin are Marriott STARWOOD Hotels.

See https://www.washingtonpost.com/busi...acting-million-guests/?utm_term=.7de9f0452004

"Marriott discloses massive data breach affecting up to 500 million guests "
"Marriott International said on Nov. 30 its Starwood Hotels brand's reservation database was breached by an unauthorized party that had access since 2014. (Reuters)".

You might want to follow up on this data .

 

[BoarderPhreak]

Not potential - for real, and for the last FOUR years...

Which is doubly maddening, because they knew about it exactly three years ago in 2015 that they were hacked over the (then) past year.

Info from Starwood/Marriott/Kroll

 

["El Gran Magnifico"]

Having logged 89 nights since 2014 using multiple cc's, and having spent 2 hours on the phone today getting new cards issued (better safe than sorry).

I'd like to be the first on this forum to say "Starwood you s*ck". And Marriott you s*ck too, for acquiring the s*ckiness."

 

[Y-Guy]

@BoarderPhreak is that assuming it was that malware that related to this breach? I don't see they've linked the two so far.

@scorp16 I'll actually give Marriott some credit for finding it and at least from outward appearances jumping on it and getting some help. They've had a bad enough black eye from the Marriott-SPG merger, this just adds insult to injury. Talk about a PR nightmare. Yikes.

 

[BoarderPhreak]

@BoarderPhreak is that assuming it was that malware that related to this breach? I don't see they've linked the two so far.

They were hacked. Twice. When it happens, you do your post mortem and batten the hatches. Improve policies and procedures. Throw hardware and software at it, and maybe a few warm bodies to watch the blinkenlights. But apparently nothing changed after the first hack; whether change happened too slowly, disregard or lack of understanding of the gravity of the situation or taking the cheap way out - it happened again, apparently almost immediately afterwards. This should alarm and anger every stakeholder, be they employees or customers.

Data breaches happen. Technology moves at an alarming rate and everyone in IT has to work fast, under budget and make the impossible happen. And as careful as you are, sometimes a step is missed, or a bug lay undiscovered. Someone, somewhere, with nothing better to do - will find it and exploit it. Because data is the new gold standard. You can rob the bank without ever leaving your desk these days. Companies stewarding our sensitive data need to take it seriously and defend it as vigorously as they do copyrights, trademarks, market share and profits. Not just as another tool in the making of the latter.

The GDPR will set them straight with a nice 4% fine.

 

[MuteSuperstar]

I loved one of the suggestions I saw in an article about this...."Give as little information as possible when making your reservation"....yeah good luck with that.
Bottom line is technology is a never-ending beta test that needs constant 24/7 babysitting to even function. This will keep happening and we'll all act surprised at the lack of transparency and preparation, and then it will happen again.

 

[fluffy]

Great...booked our Dolphin ressies for this coming week almost a year ago. Wondering now if our information was part of this. They are supposed to inform those affected by Friday. Just book another hotel for on our way to Orlando with Starwood as well. ugh!

 

[BoarderPhreak]

Last Friday, Marriott sent out millions of emails warning of a massive data breach -- some 500 million guest reservations had been stolen from its Starwood database. One problem: the email sender's domain didn't look like it came from Marriott at all. Marriott sent its notification email from "email-marriott.com," which is registered to a third party firm, CSC, on behalf of the hotel chain giant. But there was little else to suggest the email was at all legitimate -- the domain doesn't load or have an identifying HTTPS certificate. In fact, there's no easy way to check that the domain is real, except a buried note on Marriott's data breach notification site that confirms the domain as legitimate. But what makes matters worse is that the email is easily spoofable.

Many others have sounded the alarm on Marriott's lackluster data breach response. Security expert Troy Hunt, who founded data breach notification site Have I Been Pwned, posted a long tweet thread on the hotel chain giant's use of the problematic domain. As it happens, the domain dates back at least to the start of this year when Marriott used the domain to ask its users to update their passwords. Williams isn't the only one who's resorted to defending Marriott customers from cybercriminals. Nick Carr, who works at security giant FireEye, registered the similarly named "email-mariott.com" on the day of the Marriott breach. "Please watch where you click," he wrote on the site. "Hopefully this is one less site used to confuse victims." Had Marriott just sent the email from its own domain, it wouldn't be an issue.

 

[Minthorne]

This is my Credit Card guard.

 

[fluffy]

Last Friday, Marriott sent out millions of emails warning of a massive data breach -- some 500 million guest reservations had been stolen from its Starwood database. One problem: the email sender's domain didn't look like it came from Marriott at all. Marriott sent its notification email from "email-marriott.com," which is registered to a third party firm, CSC, on behalf of the hotel chain giant. But there was little else to suggest the email was at all legitimate -- the domain doesn't load or have an identifying HTTPS certificate. In fact, there's no easy way to check that the domain is real, except a buried note on Marriott's data breach notification site that confirms the domain as legitimate. But what makes matters worse is that the email is easily spoofable.

Many others have sounded the alarm on Marriott's lackluster data breach response. Security expert Troy Hunt, who founded data breach notification site Have I Been Pwned, posted a long tweet thread on the hotel chain giant's use of the problematic domain. As it happens, the domain dates back at least to the start of this year when Marriott used the domain to ask its users to update their passwords. Williams isn't the only one who's resorted to defending Marriott customers from cybercriminals. Nick Carr, who works at security giant FireEye, registered the similarly named "email-mariott.com" on the day of the Marriott breach. "Please watch where you click," he wrote on the site. "Hopefully this is one less site used to confuse victims." Had Marriott just sent the email from its own domain, it wouldn't be an issue.

So...what is the solution for the customers who might be a part of the hack? Is changing a password going to do any good or is it too late for that? I am almost at a point where I want to stop doing business of any kind on the Internet and use it solely for entertainment and research purposes.

 

[TheGuyThatMakesSwords]

So...what is the solution for the customers who might be a part of the hack? Is changing a password going to do any good or is it too late for that? I am almost at a point where I want to stop doing business of any kind on the Internet and use it solely for entertainment and research purposes.

Of interest - my wife and I are NOT affected, but looking over today's news?

It appears that Starwood is willing to pay for new passports, for affected guests. It also appears that a CA lawsuit has been filed.... .

Also - a LOT of us frequent the Swolphin RESTAURANTS, as opposed to booking rooms. My initial take is that the Restaurant CC systems were NOT breached. This is a guess: and a really good reason to have a "Vacation CC", separate from an "everyday card". We have one - and are now monitoring it DAILY.