Massive Marriott Data Breach Affects up to 500 Million Guests

Marriott International said Friday the data of up to 500 million of its guests has been stolen from its Starwood guest reservation database. The data breach is likely one of the largest ever in US history.

The hotel chain, which is the world's largest, said in a release on Friday that it was first alerted to the hack in September after receiving notification from an internal security tool that there was an attempt to access customers' data. The company started an investigation and learned that hackers have had access to Starwood guest database since 2014.

For four years, the hackers stole and encrypted customers' personal information, creating their own database of Starwood guests' data. It took Marriott until Nov. 19 to decode most of the breached information.

For about 327 million guests, the hackers absconded with "some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preference," Marriott said.

An undisclosed number of customers also had their payment card numbers and expiration dates breached. That information was encrypted in two parts, but the hotel chain said it can't rule out that both were stolen and decoded.

For the remaining chunk of guests, the stolen information "was limited to name and sometimes other data such as mailing address, email address, or other information," Marriott said.

“We are still investigating the situation so we don’t have a list of specific hotels. What we do know is that it only impacted Starwood brands,” Marriott spokesperson Jeff Flaherty told Reuters.

The hotel chain apologized to customers and has taken steps to address the security issues. Marriott is working with law enforcement on the breach. It also is providing affected customers with one free year of an information protection service, called WebWatcher. The company will start contacting affected customers by email on Friday.

*This post has been updated with Marriott's spokesperson's comments.