Three 2018 Data Breaches From the Privacy Rights Clearinghouse: Marriott, MyFitnessPal and Facebook Root Causes and Risks

Assignment: Three data breach cases from 2018

Utilize the Privacy Rights Clearinghouse (privacyrights.org/data-breaches) and report on three cases of data breaches. Your report should identify root causes of the breaches and potential risks that were exposed. Choose three cases from 2018.

Original example for study purposes (about 950 words).

Root Causes and Risks in Three 2018 Data Breaches

Introduction

The Privacy Rights Clearinghouse (PRC) maintains a chronology of publicly reported data breaches in the United States, drawn from notifications filed with state attorneys general and federal agencies (Privacy Rights Clearinghouse, n.d.). The year 2018 included some of the largest breaches ever reported, and it was also the year the European Union’s General Data Protection Regulation took effect. This report examines three 2018 breaches, Marriott International’s Starwood guest reservation database, Under Armour’s MyFitnessPal app and Facebook’s “View As” vulnerability, and identifies their root causes and the risks they exposed.

Case 1: Marriott International (Starwood Guest Reservation Database)

What happened. In September 2018, Marriott detected an attempt to access the guest reservation database of Starwood Hotels and Resorts, which Marriott had acquired in 2016. Investigation revealed that attackers had been inside Starwood’s network since 2014. Marriott announced the breach in November 2018, initially estimating that up to 500 million guests were affected. The UK Information Commissioner’s Office (ICO) later reported that about 339 million guest records worldwide were affected, including names, email addresses, phone numbers, passport numbers, arrival and departure information and loyalty program information (Hunton Andrews Kurth, 2020).

Root causes. The ICO identified four principal failures: insufficient monitoring of privileged accounts, insufficient monitoring of databases, failure to harden servers, for example by application whitelisting, and failure to encrypt certain personal data, including some passport numbers (Hunton Andrews Kurth, 2020). A further root cause was weak cybersecurity due diligence during the acquisition. Marriott inherited a compromised system and continued to use it for two years without discovering the intrusion.

Risks exposed. Passport numbers, travel histories and contact details create risks of identity theft, targeted phishing, travel fraud and, for government officials or business travelers, espionage. For organizations, the case showed the importance of security reviews during mergers. In October 2020, the ICO fined Marriott £18.4 million under GDPR (Hunton Andrews Kurth, 2020).

Case 2: Under Armour (MyFitnessPal)

What happened. On March 25, 2018, Under Armour discovered that an unauthorized party had acquired data associated with about 150 million MyFitnessPal user accounts in late February 2018. The data included usernames, email addresses and hashed passwords; payment card data were not affected because they were collected and processed separately (Cimpanu, 2018). Under Armour began notifying users on March 29, four days after discovery.

Root causes. The company did not publicly disclose exactly how attackers gained access, so the specific entry point is unknown. However, one contributing weakness was clear: although a majority of passwords were hashed with the strong bcrypt function, the rest were hashed with SHA-1, an older and much faster algorithm that is easier to crack (Wagenseil, 2018). Using two hashing methods suggests incomplete migration from legacy security practices.

Risks exposed. The main risk was credential stuffing: because many people reuse passwords, cracked MyFitnessPal passwords could be used to break into users’ email, banking and shopping accounts. Email addresses also enabled phishing campaigns that impersonated the company. The case showed the value of strong password hashing, encouraging users to change reused passwords and offering multifactor authentication. It was also a positive example of fast disclosure.

Case 3: Facebook (“View As” Access Token Breach)

What happened. On September 25, 2018, Facebook engineers discovered that attackers had exploited a vulnerability involving the “View As” feature, which lets users see their profile as someone else would. Attackers stole access tokens, the digital keys that keep users logged in, which allowed them to take over accounts. Facebook initially reported that almost 50 million accounts were affected and reset tokens for about 90 million accounts as a precaution (Rosen, 2018). The company later reduced its estimate and reported that attackers had accessed data from about 29 million users (Security Affairs, 2018).

Root causes. The breach resulted from the interaction of three software bugs. “View As” incorrectly allowed a video upload tool to appear, a version of the video uploader introduced in July 2017 generated an access token with the permissions of the Facebook mobile app, and that token was generated for the user being looked up rather than the viewer (Rosen, 2018). The root cause, therefore, was insufficient security testing of how features interacted, a design and code review failure rather than a single misconfiguration.

Risks exposed. Stolen tokens could give attackers full control of accounts and access to private messages, photos and personal information, as well as access to third-party apps that used Facebook Login. Exposed data, such as phone numbers, email addresses and personal details, could support phishing and social engineering. The case also showed the risk of concentrating identity for many services in a single platform.

Comparison and Lessons

Although the three breaches had different technical causes, they share several lessons. First, detection matters: Marriott’s attackers remained undetected for four years, while Under Armour and Facebook detected their breaches within weeks, which reduced harm. Second, legacy systems and practices are dangerous, whether they are inherited networks or outdated password hashing. Third, secure software development and testing must examine how features interact, as the Facebook case shows. Fourth, encryption and data minimization reduce the impact of a breach, since data that are not stored or are properly encrypted cannot be misused. Finally, regulation is increasing the cost of failure, as shown by Marriott’s GDPR fine. Organizations should implement continuous monitoring, privileged access controls, cybersecurity due diligence in acquisitions, modern hashing, multifactor authentication and incident response plans.

Conclusion

The Marriott, MyFitnessPal and Facebook breaches of 2018 exposed hundreds of millions of records and revealed weaknesses in monitoring, encryption, password storage and software design. Each case exposed individuals to identity theft, account takeover and phishing, and each showed organizations that security must be built into acquisitions, development and everyday operations.

References

Cimpanu, C. (2018, March 29). Under Armour announces data breach of 150 million user accounts. BleepingComputer. https://www.bleepingcomputer.com/news/security/under-armour-announces-data-breach-of-150-million-user-accounts/

Hunton Andrews Kurth. (2020). ICO fines Marriott International £18.4 million for security breach. The National Law Review. https://natlawreview.com/article/ico-fines-marriott-international-184-million-security-breach

Security Affairs. (2018, October 23). For the first time Japanese commission ordered Facebook to improve security. https://securityaffairs.com/77315/

Privacy Rights Clearinghouse. (n.d.). Data breach chronology. https://www.privacyrights.org/data-breaches

Rosen, G. (2018, September 28). Security update. Meta. https://about.fb.com/news/2018/09/security-update/

Wagenseil, P. (2018, March 29). MyFitnessPal breach hits 150 million: What to do now. Tom’s Guide. https://www.tomsguide.com/us/myfitness-pal-data-breach,news-26885.html

More model assignments posted today

• Friends vs. acquaintances (Simon Sinek)
• ADHD psychiatric evaluation (Sarah Higgins)
• Computer forensics: the BTK case
• ITHBC literature review
• Sentinel event internal memo
• "Aha! and Huh?" structured literacy
• ABS instructional strategies toolkit
• Middle childhood friendships
• Kohlberg moral dilemma
• Nursing informatics competencies