Starwood Hotel’s Mega Hack – guest reservation database of 500 Mn compromised

Starwood Hotels and Resorts Worldwide, LLC is a subsidiary of US based hotel chain Marriott International.  As per recent news in last week of Nov., 2018, Starwood Hotels has faced cyber hack which was identified by hotel on 19^th Nov. 2018 when investigators found encrypted data in an unspecified location. Breach has exposing entire data of 500 Mn guests booking over four years. Out of 500 Mn guests booking, more than 300 Mn included customers name, mailing address, phone number, email addresses, passport number, Starwood Preferred Guest (‘SPG’) account information, date of birth, gender, arrival and departure information, reservation date, and communication references.

Marriott has notified about the incident to US Law enforcement agency. Also, hotel is emailing customers informing about the hack and requesting customers to change password to avoid misuse of critical information.

Starwood Hotel’s Mega Hack has become one of the biggest hacks of an individual organisation ever.

Cyber Insurance as solution for such incidents –

Cyber Insurance policy is designed to pays various expenses at pre-loss prevention and post loss services and also pays damages awarded against Insured along with defence cost incurred in defending claims.

1) Business Interruption – net profit loss cover

Because of Cyber incidence Insured may not be able to conduct normal operation which may last for weeks and few months. Business loss is major threat to Insured as it has direct and major impact on net profit of Insured.

Cyber Insurance policy provide cover for loss of net profit after cyber incident subject to excess (usually 12hrs or 24hrs waiting period as excess) till restoration of normal business operations.

2) Cyber Incident Response cover –

As part of response to cyber incidence, following expert teams may be required –

• Cyber Forensic expert team – for cyber forensic investigation
• PR agencies – for public relation consulting
• Legal requirements – to defend Insured in Court of Law from claim brought by customers and other parties
• Credit monitoring services – required to track customer’s critical documents to ensure documents are not misused.

Cyber Insurance Policy covers reasonable expenses and fees charges by these response teams.

3) System damage & rectification / Post-Breach Remediation Costs/Restoration cost cover – Cyber Insurance Policy will pay reasonable expenses of rectification of systems as well as restoration of data.

4) Digital Media Liability – Defamation or Intellectual property rights infringement – Cyber Insurance Policy pays for defence cost and damages awarded in defamation suits and IPR related suits (relating to or arising from cyber incidence) from customers.

Other major covers available under Cyber Insurance are –

1. Cyber extortion & ransoms cover
2. Computer fraud & Funds transfer fraud cover
3. Outsource service providers cover, etc.

Underwriting Information

Duly filled proposal form or application form is required to underwrite the Cyber Insurance Policy. Important information which are reviewed by Insurer to underwrite Cyber Insurance policy are –

1. Business activity
2. Detail of Gross online revenue for 3 years of Insured
3. Geographical spread of Insured
4. No of IP Addresses & active ID address of Insured
5. Data Protection Policy of Insured
6. IT Security plan
7. DDoS attack preparedness by Insured etc.

Indicative Premium for Limit of Liability (SI) is mentioned as below-

-Warm Regards

Beacon Insurance Brokers Pvt Ltd

Reference: https://www.thenational.ae/business/technology/marriott-hotels-cyber-attack-privacy-of-500-million-guests-compromised-1.797701