This is basically a PR piece on how careful they're being and how "seriously" they're treating it. > Uncovering the full scope of the attack took significant f

This is basically a PR piece on how careful they're being and how "seriously" they're treating it. > Uncovering the full scope of the attack took significant forensic work, the CEO said. However, despite the RAT's presence on the Starwood IT system, at that point, there was no evidence that unauthorized parties had accessed customer data located in Starwood's guest reservation database. > By the next month, in October, the forensic firm also found Mimikatz [...]. The tool was most likely used to help hackers acquire passwords for other Starwood systems and help them move to other parts of the IT network. > Yet again, investigators didn't find evidence that hackers had accessed customer data. > Yet again, there was still no evidence of hackers accessing customer data. With infrastructure so compromised, and so few protective measures, the default assumption has to be some kind of customer data was accessed. Spin at its worst. And while I haven't watched the hearing, you'd expect a post-mortem to include maybe how they gained access, and measures to fix it in future. Even if the CEO didn't elaborate, you'd expect a reporter to ask similar questions, and at least point out nothing was said.