MGM Resorts recently confirmed that the company experienced what appears to be a massive cyberattack, causing the company to shut down operations at multiple properties.
Data breach security and insurance experts spoke at the Hospitality Law Conference Washington, D.C., about growing threats for cybersecurity and the increasing difficulty in getting insurance coverage.
The company confirmed to TechCrunch that it has put in place 'a mechanism to enable guests to look up individual passport numbers to see if they were included in the set of unencrypted passport numbers.'
'With all the resources they have,' says Andrei Barysevich, a researcher with the threat intelligence company Recorded Future, 'they should have been able to isolate hackers back in 2015.'
Because of the size of the breach and the underlying issues that may have caused it, many may point to the hotel sector's drive towards personalization and trigger a major rethink.
The Marriott data breach, however it ultimately plays out, should be a wake-up call for the hospitality industry. Owners, operators and brands need to create effective and comprehensive policies, procedures and systems to address an increasingly dangerous data environment.
In what is one of the largest data breaches to ever occur, cybercriminals broke into Marriott's servers in 2014, obtaining the personal information of approximately 500 million Marriott customers. These nefarious actors then roamed freely throughout Marriott's system, with unfettered and undetected access, for four years.
The compromised customer info includes passport numbers, emails and mailing addresses
Marriott has taken measures to investigate and address a data security incident involving the Starwood guest reservation database. On November 19, 2018, the investigation determined that there was unauthorized access to the database, which contained guest information relating to reservations at Starwood properties* on or before September 10, 2018.
A Chinese hotel group is investigating the possible leak of millions of customers' records, which appear to be for sale on the internet.