Marriott Data Breach Exposes PII, Credit Cards

Marriott International has acknowledged yet another data breach, this time impacting between 300 and 400 individuals.

Marriott told Dark Reading that it was a social-engineering scam that was able to trick a single hotel employee into turning over credentials for computer access. Now, the attackers want extortion money. The hotel chain added that it’s preparing to notify people who were compromised.

DataBreaches.net was first to report on the latest Marriott compromise after the outlet said the threat actors contacted it to boast about the breach. The report said the Marriott attackers specifically targeted the Marriott at the BWI airport in Baltimore, Md., and were able to exfiltrate 20 GBs of data, including credit card details.

“The threat actor did not gain access to Marriott’s core network,” a Marriott spokesperson said in a statement to Dark Reading. “Our investigation determined that the information accessed primarily contained non-sensitive internal business files regarding the operation of the property.”

The spokesperson added that the company was already aware of the incident and investigating before the attacker contacted Marriott with payment demands. Marriott refused to pay and is working with law enforcement, the person said.

According to the DataBreaches.net report, some of the information exposed included personal identifiable information (PII) for flight crews staying at BWI, including names, flight numbers and times, employment position, room number, and the credit card used for booking.

Attack Follows Massive Marriott Breach in 2020

This latest incident pales in comparison to the 2020 Marriott breach that exposed the PII of more than 5.2 million members of the hotel chain’s loyalty program. But it illustrates how vulnerable organizations can be to follow-on attacks after an initial compromise, according to Jack Chapman, vice president of threat intelligence at Egress.

“As this latest data breach demonstrates, organizations that are victims of previous attacks are more likely to be targeted in the future,” Chapman said in an email to Dark Reading. “Social engineering is a highly effective tool, and cybercriminals know that an organization’s people are its biggest vulnerability — which is why they return to this technique again and again.”

The results are undeniable: social engineering works.

“A primary mechanism being used by adversaries is social engineering,” Saryu Nayyar, CEO and founder of Gurucul, explained via email. “It’s simple and effective. And it means that initial compromise is dependent on human behaviors and is therefore impossible to prevent 100% of the time. All it takes is one successful compromise to circumvent most preventive controls.”

Finding and securing the organization’s most valuable data is a good first step to protecting against these increasingly common social engineering schemes, James McQuiggan, a security awareness advocate at KnowBe4, says.

“Too often, in data breaches, it is discovered that users have access to more data required to do their tasks effectively, and it is only found after the breach when it’s on the Dark Web being copied around that the user did not need it,” McQuiggan adds. “Any sensitive data, like names, emails, or other personnel data like HR reviews, are to be protected with multifactor authentication to increase the protection and reduce the risk of an attacker having easy access.”