Marriott Data Breach

Some links to credit cards and other products may earn a referral commission. Furthermore, as an Amazon Associate I earn from qualifying purchases. For full advertising disclosure, click here

Marriott and Starwood recently completed a merger that made the company the largest hotel chain in the world. After the merger, the company’s number of annual guests was astronomical.  Having such a large guest database meant the company had a lot  of guests’ personally identifiable information stored on their servers.  In the past, the company did a decent job of protecting the information.  That came to an end when  Marriott announced that it experienced a massive data breach.  Portions of the press release are below:

On November 19, 2018, the investigation determined that there was unauthorized access to the database, which contained guest information relating to reservations at Starwood properties* on or before September 10, 2018.

On September 8, 2018, Marriott received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database in the United States.  Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014.  The company recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it.  On November 19, 2018, Marriott was able to decrypt the information and determined that the contents were from the Starwood guest reservation database.

The company has not finished identifying duplicate information in the database, but believes it contains information on up to approximately 500 million guests who made a reservation at a Starwood property.  For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences.  For some, the information also includes payment card numbers and payment card expiration dates, but the payment card numbers were encrypted using Advanced Encryption Standard encryption.

Marriott has begun emailing the guests whose information was compromised.  Guests from the United States will receive a complimentary one year enrollment in WebWatcher (an internet monitoring program).

Final Word

Much like the breaches of Equifax, Sonic, and Cathay Pacific, this loss of personal information will be felt worldwide.  I applaud Marriott for finally detecting the breach, but four years seems like a long time to do so.  Contact Marriott if you feel that your information has been compromised.