Marriott announced on 30 November 2018 unauthorised access, since 2014, to the Starwood reservation database, with data on up to 500 million guests. What it said, what EU rules require and what it teaches anyone buying a company.
On 30 November 2018, Marriott International announced that an unauthorised third party had accessed the guest reservation database of Starwood, the hotel group it bought in 2016. According to the company, on 8 September an internal security tool flagged an attempt to access that database in the United States. The investigation that followed concluded that the Starwood network had been accessed since 2014, and on 19 November the company managed to decrypt the information that had been copied and confirm that it came from that database.
What data, and how many people
Marriott estimates that the database may contain information on up to about 500 million guests who made a reservation at a Starwood property, although it was still removing duplicates. For about 327 million, the data are a combination of name, postal address, telephone number, email address, passport number, loyalty account details, date of birth, gender, arrival and departure dates, reservation date and communication preferences. For the rest, the information is limited to the name and, sometimes, a little more.
In some cases the database included payment card numbers and expiry dates. The company explained that they were encrypted with the AES-128 standard and that decrypting them requires two components, but it cannot rule out that both were taken.
Marriott said it had informed law enforcement and had begun notifying regulators, without saying which. It has opened a call centre, is emailing affected guests whose address is in the database and is offering, for one year, a personal-data monitoring service in the countries where it is available. Its chief executive, Arne Sorenson, expressed regret and said the company is phasing out Starwood’s systems.
What the GDPR requires
The General Data Protection Regulation (GDPR), applicable since 25 May 2018, requires the controller to notify a personal data breach to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it; if it is not made in time, the reasons for the delay must be given. Fines can reach €20 million or 4% of worldwide annual turnover for the previous financial year, whichever is higher, for the most serious infringements, such as breaching the basic principles of processing, and €10 million or 2% for other obligations, such as those on security and notification.
Because the intrusion was detected in September and announced at the end of November, several experts pointed out that it might fall outside that deadline; it is for the data protection authorities to assess from when it should be counted and what penalties would follow.
The lesson for anyone buying a company
Marriott acquired Starwood in 2016. According to the company’s statement, access to the Starwood network goes back to 2014, that is, before the purchase, and an analyst at the research firm Forrester said the intrusion went unnoticed during the integration of the two companies. The case shows that whoever buys a company also inherits its technology risks: an old intrusion can come to light years later, with legal and reputational consequences, and under a penalty regime calculated on the group’s turnover.
In a company purchase, due diligence can include cybersecurity: asking for the history of incidents and audits, knowing what personal data the target company handles and where it stores it, checking whether it complies with the GDPR and the rules of its sector, reviewing its insurance and its contracts with technology suppliers, and including in the purchase agreement specific representations, warranties and indemnities on these risks. After closing, it is advisable to analyse inherited networks before connecting them to one’s own and to set a timetable for retiring the old systems.
The security of data is part of a company’s value, and also of what is bought along with it.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
