Nothing was 'lost'. A misplaced laptop is lost; records from a database are accessed (or 'stolen', but I think that's problematic as well). The fact that the ac

Nothing was 'lost'. A misplaced laptop is lost; records from a database are accessed (or 'stolen', but I think that's problematic as well). The fact that the access was possible says nothing about the hackers and everything to do with Marriott's security approach and posture. Can we please stop letting companies hand-wave away these attacks and stop solely blaming hackers? I've worked with hundreds of companies' security teams. While I've seen a select few companies do a really great job, most were either negligent, incompetent, or both. I'm sick of the blame for this being laid solely at the feet of the abstract "hackers", rather than the people who make these attacks utterly trivial. (Posted from a throwaway because Marriott may or may not be a customer of mine. Ugh.)