Real talk about the @marriott announcement. The issue was discovered on September 8th. This wasn't simply an issue of "the logs had evidence on the 8th." We know this because they changed something on the 10th (see the end of paragraph 1). 1/n
news.marriott.com/2018/11/marrio…
news.marriott.com/2018/11/marrio…
What does this even mean? It's either intentionally misleading or so vague as to be meaningless. Was the data discovered on the dark web? Probably not since it was encrypted. Was it discovered on another internal machine? How did Marriott know it was sensitive? 2/n
That sentence specifically leaves me with more questions than answers. Infosec peeps: work with your PR teams to draft statements that don't leave experts (and press) scratching their heads wondering if you know what you're talking about. 3/n
Given the timeline of the breach, it's clear that either Marriott bought the system in a breached condition or they were given a copy of the data (perhaps for due diligence) and failed to secure it themselves. This sentence seems to imply the former. 4/n
But given the inarticulate wording in the rest of the post, I'm not going to read too much into a statement from the CEO (which could be intentionally worded to lead people to that conclusion). 5/n
Starwood had crossover rewards programs with at least @delta (pretty sure there were others). No word yet on how those systems might have been impacted. Why not? They've had months to investigate this and draft the statement. 6/n
For a breach of this magnitude, with almost 3 months to investigate, the lack of detail in this statement is underwhelming. I'll be using this as a case study with clients on how NOT to announce a breach. 7/7
