Forest Global Training Partners

Cyber Risks · Krebs on Security

Password Re-use Fuels Starwood Fraud Spike

Summary: A Starwood-specific account-checking tool released for free on Leakforums[dot]org let members test credentials stolen in earlier breaches against Starwoods.com, and within 24 hours more than a half dozen Leakforums members were selling hijacked accounts. One seller advertised a Starwood account holding 70,000 points for $3, while accounts with about 40,000 points sold for $1.50, and buyers cashed out by forcing the hijacked balance to transfer to a new account and then exchanging points for gift cards.

Why it matters: The entire spike rests on password re-use: a stolen email-and-password pair from an unrelated breach was enough to open a loyalty account worth 70,000 points, priced at $3 on a forum. Starwood's Chris Holdren says no guest will lose a single point, but the buyers' tutorial tells them to change the victim's email, password and contact details, locking the legitimate user out.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related