Looking at this Marriot breach I’m starting to think maybe they didn’t encrypt their credit card data very well.
The question is whether plaintext card numbers were stolen at the point of sale terminals (do hotels have real PoS terminals?), some other system that saw plaintext, some point of decryption, or if the attackers just got the private keys.
Sometimes I feel like encryption is counterproductive, just because bad encryption is often worse than no encryption — in the sense that it makes regulators go away without doing anything to protect customer data.
🤷♀️ 
Notice the phrasing here: both components (meaning the decryption keys) may have been “taken”. Not “accessed”. Sounds like they didn’t store the keys inside of an HSM, they just put them on a server somewhere.
“We locked our doors with two separate keys and put them under two completely different potted plants.”
