we'd notice if someone was in our systems

what everyone assumed

A large organisation has security tools, logs, and people whose job is to watch for trouble, and the reasonable belief that follows is that an intruder inside your systems would surface: an alarm, an anomaly, a noticed login. It is a comforting and ordinary assumption, because it is the whole point of having the tooling in the first place. The belief is that presence gets detected, that four years of someone inside your database is simply not something that can happen without anyone noticing.

what happened

It happened across four years. The FTC later found that the environment lacked the things that turn presence into a signal: network segmentation, adequate logging and monitoring, appropriate access controls, adequate multi-factor authentication. The access spanned a corporate acquisition, and during that acquisition the buyer did not complete a detailed security review of what it was absorbing, which meant the intruder already inside Starwood’s systems was never surfaced by the diligence either. Quarter after quarter, the database returned answers to a visitor who was not supposed to be asking, and no screen lit up to say so.

how it surfaced

On September 8, 2018, an internal tool flagged a suspicious attempt to access the Starwood reservation database, and the long stay finally became visible. Marriott disclosed the breach on November 30, 2018. The regulator’s account put the scale at 339 million Starwood guest records worldwide, including 5.25 million unencrypted passport numbers, accessed across a window that ran from around July 2014 until that September. The detection that ended it was one alert, four years after the access began.

Noticing has to be built into a system. It does not happen on its own.

An intruder is detected when monitoring, logging, and segmentation are present to catch them, and where those are thin, presence can last for years without producing the alarm everyone assumed would come.