Why Chinese Hackers Stole the Private Data of Marriott Hotel’s 500 Million Guests

Why Chinese Hackers Stole the Private Data of Marriott Hotel’s 500 Million Guests

Marriott International, the accommodation franchise with a broad portfolio of hotels and lodging based around the world, was recently subject to a massive data breach that compromised the personal data of their 500 million guests. As one of the largest hacks against an American hotel giant in history, the company’s security investigation has concluded hackers were able to obtain “unauthorized access” to a database holding hotel guest records dating back before Starwood Hotels was acquired in 2016.

The breach saw the collection of more than 327 million records of names, mailing addresses, phone numbers, email addresses, credit cards, passport numbers, Starwood Preferred Guests (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. Truly no privacy stone was left unturned. Investigators believe the cyberattack was a coordinated effort by Chinese intelligence-gathering firms that conducted similar hacks against American health insurers, according to sources for The New York Times.

Publicly, the company is staying quiet. “Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014,” the company declared in a public statement. “Our primary objectives in this investigation are figuring out what occurred and how we can best help our guests. We have no information about the cause of this incident, and we have not speculated about the identity of the attacker. We alerted law enforcement and are cooperating with the investigation.”

The sources who spoke with The Times believe the hackers are suspected of working on behalf of the Ministry of State Security, the Communist-controlled civilian spy agency, which reportedly uses similar hacking methodologies that points to their state-enforced action. The news comes just days before President Donald Trump was to decide on new China-related trade policies. 

The newspaper proceeded to cite four anonymous Military sources who — if we’re to trust their insider status at face value — have knowledge of the government demanding indictments against the hackers and of plans to declassify intelligence on Chinese hacking efforts since 2014. Among the other options being considered are executive orders “intended to make it harder for Chinese companies to obtain critical components for telecommunications equipment.”

The reason the government appear concerned with the hack isn’t just nationalist posturing. The officials, who also spoke with The Associated Press under the condition of anonymity, explains the data breach was a high-value target due to the Marriott being frequently used by the military and government agencies, though the extent of their involvement with the organization wasn’t disclosed. Outside of the obvious identity theft money to be reaped, the move could possibly place soldierly personal in danger, granting hackers a trove of intelligence to link back to military status.

“No, this is not about tracking a family’s annual vacation to Orlando,” writes journalist Jesse Varsalone of The Washington Post.Instead, it is more likely to involve watching individuals who have key roles in either government or business. For any individual, group or nation-state focused on, say, the foreign ties of adversarial countries or political operatives, information about who checked in to a given hotel, in a given country, on a given day could be invaluable. That information would have been obtained in the Marriott hack.”

“Consider the payoff for such a hack,” he continues. “The adversaries of the United States would be able to see who is staying at a Marriott property when, for instance, the U.S. president is in town. They would then be able to determine whether anyone from that list checks in to a Marriott property at the next city on the president’s itinerary. A roster of people with travel schedules congruent to the president’s would certainly be of interest. Once a person of interest is discovered, one could start to look at others who have similar hotel records and then extrapolate co-workers, associates and anyone who travels in the same circles… [it can] be used for any number of nefarious purposes — such as blackmail or advancing a political or intelligence agenda.”

This essentially leaves the foreign power with a web of political leverage to be used against any Marriott-linked official they so desire — including the president of all things controversial. China, of course, pleads up and down this is all just unethical behaviour. Geng Shuang, a spokesman for the communist party’s Ministry of Foreign Affairs, said “China firmly opposes all forms of cyberattack and cracks down on it in accordance with the law. If offered evidence, the relevant Chinese departments will carry out investigations according to the law.” 

Don’t hold your breath for such cooperation, however, given the absolute censorship-state against their citizens. Imagine how they must treat their political enemies. This gives the Pacific’s trade negotiators some international clout before deciding their agreement where, according to the Times, China would commit to purchasing $1.2 trillion more of American goods and services over the next several years, and would address intellectual property concerns. An international form of power politics is effective for negotiation, after all. Surely Trump’s “Art Of The Deal” ghostwriter mentioned such brutal tactics somewhere.

In the past, Trump has told Reuters he would consider intervening in the Canadian-Huawei case if it would “help serve national security” and “help get a trade deal done with China”, which would place Trump against the coordinated effort by his Justice Department to arrest Meng Wanzhou, the CFO of the controversial telecom involved with hacking scandals. Could the president cuck to Chinese influence to secure better relations? “If I think it’s good for what will be certainly the largest trade deal ever made,” Trump said,
“which is a very important thing, what’s good for national security, I would certainly intervene if I thought it was necessary.” 

Their latest effort could just be reassurances. “Ultimately, corporations such as Marriott can’t go it alone,” Varsalone concludes. “The collective resources of industry, government, academia and citizens working in concert will be required to successfully combat a cyberthreat realm that continues to grow in both size and sophistication.”

Related News