Photo credit: www.techradar.com
The FTC is imposing strict rules on the Marriott Hotel chainThree huge data breaches from the Marriott led to hundreds of millions of customers being exposedFTC says the company failed to implement proper security measures
The Federal Trade Commission (FTC) has directed Marriott International and Starwood Hotels to strengthen their customer data security practices following a series of significant security lapses in recent years.
From 2015 to 2020, Marriott experienced three major data breaches, which compromised the personal information of over 344 million customers globally. This included sensitive data such as passport information, credit card details, and other identifiable information.
Under the new FTC ruling, Marriott is now required to create and sustain a comprehensive information security program, which must incorporate strong encryption, access controls, multifactor authentication, and a well-defined incident response strategy. In addition, continuous monitoring of all IT assets for security threats is mandated, along with protocols for retaining personal data only as long as necessary.
Poor security practices
The ruling also stipulates that Marriott conduct independent assessments of its information security measures every two years. Any identified security vulnerabilities or breaches must be reported to the FTC within a 10-day timeframe. These regulations will be in effect for the next two decades.
Customers will now have the ability to review potential unauthorized activities in their accounts and request the deletion of their data and personal information from Marriott’s systems.
Marriott acknowledged that serious security shortcomings contributed to the breaches, as a lack of secure encryption left the company’s data vulnerable to cyberattacks. It is estimated that hackers had illicit access to Marriott systems for as long as four years. Earlier this year, the FTC imposed a $52 million fine on the company, stating that Marriott attempted to conceal the breaches and “misled consumers by asserting they had adequate and appropriate data security.”
Via BleepingComputer
You might also like
Source
www.techradar.com