Loading story…
Marriott disclosed that attackers had compromised the Starwood guest reservation database, exposing records tied to hundreds of millions of guests who stayed at Starwood properties on or before Sept. 10. The company initially said the incident could affect up to 500 million guests, later revising the figure to fewer than 383 million, while stating that at least 327 million records contained personal data such as names, mailing addresses, phone numbers, email addresses, passport numbers, birth dates, gender, and in some cases encrypted payment card details. The breach prompted law-enforcement notification and regulatory scrutiny, including an investigation announced by New York's attorney general.
MGM Resorts separately faced repeated fallout from cyber incidents affecting hotel guests. Guest details for 10.6 million MGM customers were later found posted on a hacking forum, and in a subsequent cyberattack the company said intruders stole customer information including Social Security numbers and passport data while disrupting reservations, casino gaming, digital room keys, websites, and mobile apps across most properties. MGM estimated the September attack would cut results by about $100 million and add roughly $10 million in response costs, with reporting attributing the intrusion to social-engineering tactics linked to Scattered Spider and ALPHV/BlackCat.
See attribution, scope, and your downstream exposure.
12 events from the most recent confirmed update back to the earliest known activity.
In an SEC filing, MGM said the September 2023 cyberattack would reduce third-quarter results by about $100 million, with less than $10 million in additional consulting, legal, and advisory costs. It also disclosed that customer personal information, including Social Security numbers and passport data for some individuals, had been exposed, though no payment card data was accessed.
By early October 2023, MGM said most affected systems had been restored and properties had largely returned to normal operations. The company also said it was notifying impacted customers and offering identity protection or credit monitoring services.
Security researchers and reporting attributed the MGM intrusion to a social engineering attack associated with Scattered Spider, allegedly working with the ALPHV/BlackCat ransomware gang.
MGM Resorts said it discovered a cyberattack on September 11, 2023 and shut down systems to contain it. The incident caused widespread disruption across casino and hotel operations, affecting reservations, gaming, digital keys, websites, and mobile apps.
On or around July 13, 2020, reporting said a hacker was selling details of 142 million MGM hotel guests on the dark web. The sale represented a major escalation from the earlier exposure of 10.6 million MGM guest records posted on a hacking forum.
Details belonging to 10.6 million MGM hotel guests were posted on a hacking forum, exposing customer information from a prior incident affecting the hotel and casino operator.
Marriott disclosed that the Starwood breach exposed about 5.25 million unencrypted passport numbers and roughly 20.3 million encrypted passport numbers. The update refined the scope of sensitive data compromised beyond the company's initial November 2018 disclosure.
Reporting on December 11-12, 2018 said investigators had traced the Marriott Starwood breach to a Chinese intelligence-gathering campaign. The attribution reframed the incident as part of a broader espionage effort rather than only a large-scale data breach affecting hotel guests.
Following Marriott's disclosure, New York Attorney General Barbara Underwood announced an investigation into the Starwood data breach.
On November 30, 2018, Marriott publicly disclosed the Starwood database breach, initially saying up to 500 million guests could be affected and that at least 327 million records contained personal data such as contact details, passport numbers, birth dates, and some payment card information. The company said it had reported the incident to law enforcement.
Marriott said it learned on November 19, 2018 that an unauthorized party had copied and encrypted information from the Starwood guest reservation database. The breach potentially affected guests who stayed at Starwood properties on or before September 10, 2018.
Marriott later said unauthorized access to the Starwood guest reservation database dated back to 2014, indicating the compromise had persisted for years before discovery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecybersecuritydive.com
Open sourcezdnet.com
Open sourcezdnet.com
Open sourcecnet.com
Open sourceaxios.com
Open sourcezdnet.com
Open sourcefoxbusiness.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple organizations reported or resolved matters related to cyber incidents affecting sensitive personal data. **Choice Hotels International** disclosed that a “skilled person” used **social engineering** to access (despite **MFA**) an application containing records for franchisees and franchise applicants, exposing data including **names and Social Security numbers**; the company indicated the incident involved franchise-related records rather than guest data. Separately, **Wynn Resorts** had not publicly responded to claims by **ShinyHunters** that the actor obtained roughly **800,000 records**, with no proof posted and no apparent public filing or statement at the time referenced; reporting suggested the alleged exposure may involve employee data rather than guest data. In Taiwan, **The Grand Hotel (Taipei)** reported detecting unauthorized access and stated it could not yet rule out impact to **customer/guest data**. In healthcare, a small medical practice in Northern Ireland (**Grange Dental Care**) reported a compromise that led to **fraudulent emails** being sent from the practice’s systems requesting invoice payments; the practice stated it identified the issue quickly and engaged its IT provider to contain and investigate, with initial indications the attack originated overseas. Separately, **Granite Wellness Centers** (California) and **Pediatric Home Service** (Minnesota) agreed to **class action settlements** tied to earlier cyberattacks exposing patient data; Granite’s matter stems from a **January 2021 ransomware attack** in which files containing extensive patient and identity data were confirmed accessed, and the organization agreed to a **$725,000 settlement fund** while denying wrongdoing and liability.
Jun 29, 2026
Over 4 million Texans have been affected by a significant data breach at Conduent Business Services, marking one of the largest such incidents in U.S. history. The breach has prompted legal action and investigations, with the potential for compensation for impacted individuals. In a separate incident, Doctor Alliance, a healthcare technology firm serving multiple providers, suffered a cyberattack resulting in the theft of over 1.2 million records. Attackers have threatened to release sensitive medical data, including diagnoses, prescriptions, and insurance information, unless a ransom is paid, raising serious concerns about identity theft and medical fraud. Additionally, The Thayer Hotel in New York experienced a breach in which more than 33,000 individuals had personal information stolen, including government-issued IDs and, in some cases, Social Security numbers. The hotel, located near the West Point Military Academy, has offered affected individuals free identity theft protection. While there is no evidence yet of misuse, the stolen data could be leveraged for phishing, identity theft, or malware attacks, especially given the military-affiliated clientele. These incidents highlight the ongoing risks posed by cyberattacks targeting organizations that handle sensitive personal and medical information.
Jul 12, 2026
BWH Hotels confirmed a cyberattack after detecting unauthorized access on April 22 that exposed customer reservation information stored in a web application. The compromised data included guests' names, email addresses, phone numbers, postal addresses, reservation numbers, stay dates, and special requests, with records generated between **October 14, 2025** and **April 22, 2026** potentially affected. The company said payment card and bank account information were **not** impacted. BWH Hotels said it took the affected application offline, revoked the unauthorized access, and brought in external cybersecurity experts to investigate and strengthen defenses. The company also warned customers to watch for phishing and other suspicious communications—including emails, texts, WhatsApp messages, or phone calls—that reference hotel reservations or stays and could use the stolen personal details to appear legitimate.
Jun 29, 2026