Following the largest data breach in the hotel industry’s history, Marriott International is now facing the possibility that the hack may be attributed to Chinese who potentially may have been using the data for the country’s government intelligence services and the military, according to multiple sources.
The hack, which Marriott discovered in September and disclosed on November 30, had compromised data – including passport information – for roughly 500 million customers staying at Starwood hotel properties since 2014.
Investigators looking into the breach have found hacking techniques previously used in attacks attributed to Chinese hackers, according to three sources interviewed by CNBC, suggesting that Chinese hackers may have been behind a campaign designed to collect information for use in Beijing’s espionage efforts and not for financial gain, two of those sources said.
Sources close to the investigation also told CNBC the initial phases of the probe are pointing to involvement by the Chinese government. However, it’s unclear the nature of China’s involvement.
According to reporting from the New York Times, the discovery comes as the U.S. President Donald Trump’s administration is planning actions targeting China’s trade, cyber and economic policies, perhaps within days. The Times added that there has been widespread suspicion both in Washington and among cybersecurity firms that the hacking was not a matter of commercial espionage, but part of a much broader spy campaign to amass Americans’ personal data.
A spokesman for China’s Ministry of Foreign Affairs has denied any knowledge of the Marriott hacking.
Passport data would be particularly valuable in tracking who is crossing borders and what they look like, among other key data, according to a former homeland security adviser under former U.S. President Barack Obama, the New York Times also wrote. To date, Marriott has said the hotel chain would only cover the cost of replacement passports if fraud had taken place.
In 2016, the Obama administration threatened to block a US$14 billion bid by China’s Anbang Insurance Group Co. to acquire Starwood Hotel & Resorts Worldwide, so alarmed was the administration by Anbang’s effort to amass Americans’ personal information, according to the New York Times.
Ultimately, that failed bid paved the way later that year for Marriott to acquire Starwood for US$13.6 billion, becoming the world’s largest hotel chain.