 |
According to the first elements of the investigation, an IT security flaw dating back to 2014 allowed cybercriminals to get their hands on the data of 500 million group customers: surname, first name, mailing address, email address and confidential banking details.
The cyber-attack [4] in question mainly affected the reservation system of Starwood, a subsidiary of Marriott Group, purchased for 13.6 billion USD in 2016. The Starwood network includes W Hotels, Sheraton Hotels & Resorts, St. Regis, the Méridien Hotels & Resorts, Four Points by Sheraton, Design Hotels, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection and Tribute Portfolio.
The hotel group affirms that the Marriott brand has a different reservation system from that of Starwood. The latter was not hacked.
According to a study conducted by IBM, the data breach of 50 million people would cost 350 million USD. Commensurate with these figures, the hacking of the Marriott database would amount to 3.5 billion USD.
Moreover, according to the laws in force and to the General Data Protection Regulation (GDPR), the Marriott International group would be exposed, by the authorities, to a 4% fine of its global revenues, that is nearly 916 million USD.
Cyber-incidents rank second in the Allianz Risk Barometer 2018. Hotel groups are particularly exposed to this risk and are required to protect the personal data of their customers. In case of a failure, insurance may bear some of the economic losses related to the event.
In all likelihood, the Marriott chain has an insurance cover against cyber risks. Some of the losses associated with this hacking will therefore be borne by the group's insurer.
Read also: