Marriott disclosed today: the Starwood reservation database was breached for four years, since 2014, predating Marriott’s own acquisition of Starwood, exposing up to 500 million guests: passports, travel histories, the occasional unencrypted card. Two archive threads converge with a clang. First, the M&A angle: Marriott bought this breach in 2016 and ran it unknowingly for two years. Due diligence audits the books, the brand, the real estate, and treats the IT estate as furniture; “you acquire their attackers too” belongs in every deal memo (Yahoo’s discount was the precedent; a breach literally repriced that acquisition, and the industry filed it under “Yahoo problems”). Second, the duration: four years of dwell time. Breach detection lag is the metric nobody dashboards; prevention gets the budget, detection gets a log-retention policy written by the finance team. (The ceiling rule applies; expect the passport count to firm upward.)
Cheerier infrastructure: AWS re:Invent week delivered its annual firehose (the notable trend: everything moving “serverless-adjacent” and everything getting an ARM chip, Graviton, because Amazon now builds CPUs, which the supply-chain file notes with a raised eyebrow), and our own migration-scarred Kubernetes platform is now boring enough that this year’s announcements read as “optional,” the highest compliment infrastructure can earn.
TIL: dwell-time benchmarks. Industry median breach detection sits around 100-200 days depending whose report you read, and that’s the median of discovered breaches, a survivorship-biased floor. Instrument for the attacker already inside; “assume breach” was never a slogan, it’s a query you should be able to run.