Evidence in Marriott’s subsidiary Starwood hack points out to China intel

According to a report published by the Reuters, the massive Marriott data breach was carried out by Chinese state-sponsored hackers.

According to the Reuters, people investigating the Marriot data breach believe that it is the result of a cyberattack carried out by Chinese hackers.

Last week Marriott International announced that hackers compromised guest reservation database at its subsidiary Starwood hotels and stolen personal details of about 500 million guests.

Sources quoted by the media agency revealed that the attack was carried out by the Chinese intelligence to gather information.

“Hackers behind a massive breach at hotel group Marriott International Inc left clues suggesting they were working for a Chinese government intelligence gathering operation, according to sources familiar with the matter.” reads the article published by the Reuters.

“Private investigators looking into the breach have found hacking tools, techniques and procedures previously used in attacks attributed to Chinese hackers, said three sources who were not authorized to discuss the company’s private probe into the attack.”

The attribution of the Marriott data breach is based on the analysis of tactics, techniques, and procedures (TTPs) that were previously associated with Chinese APT groups.

In particular, Reuters’ sources admitted that some of the tools were exclusively used by Chinese attackers. The attribution is also difficult because the security breach occurred back in 2014, this means that since then other threat actors may have had access to the Starwood systems.

The relations between China and US are even more complicated, US Government accused in many circumstances Beijing of cyber espionage against Western entities.

Chinese authorities denied any involvement in the alleged cyber espionage operations.

“China firmly opposes all forms of cyber attack and cracks down on them in accordance with law,” Chinese Ministry of Foreign Affairs spokesman Geng Shuang told Reuters.”If offered evidence, the relevant Chinese departments will carry out investigations according to law.”

Marriott International has bought Starwood Hotels and Resorts Worldwide in 2016 for $13 billion. The brand includes St. Regis, Sheraton Hotels & Resorts, W Hotels, Westin Hotels & Resorts, Aloft Hotels, Tribute Portfolio, Element Hotels, Le Méridien Hotels & Resorts, The Luxury Collection, Four Points by Sheraton and Design Hotels.

According to the company, hackers accessed to the Starwood’s guest reservation system since 2014 and copied and encrypted the information.

The intrusion was detected on September 8 when a monitoring system found evidence regarding an attempt to access the Starwood guest reservation database in the United States. Two months later, on November 19, an investigation confirmed the intrusion into the archive containing “guest information relating to reservations at Starwood properties on or before September 10, 2018.”

Unknown hackers accessed personal information of nearly 327 million guests, compromised records include names, mailing addresses, phone numbers, email addresses, passport numbers, dates of birth, genders, arrival and departure information, reservation date.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Marriot Data breach, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]