MASSIVE Marriott Data Breach Could Impact 500 Million Guests

By: Ben Schlappig

Published: November 30, 2018

25 comments

At this point it sure seems like major breaches with travel brands are a common occurrence. The latest company to be impacted by one of these is Marriott.

Marriott is investigating a data security incident involving the Starwood guest reservation system. On November 19, 2018, the investigation determined that there was unauthorized access to the database, which contained guest information relating to reservations on or before September 10, 2018.

With this investigation, Marriott learned that there had been unauthorized access to the Starwood network going back as far as 2014. An unauthorized party had copied and encrypted information.

Marriott believes that this contains information for up to approximately 500 million guests who made a reservation at a Starwood property. For about 327 million of those guests, the information included some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences.

For others, this also included payment card numbers and payment card expiration dates.

Marriott’s CEO had the following to say:

“We deeply regret this incident happened. We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.

Today, Marriott is reaffirming our commitment to our guests around the world. We are working hard to ensure our guests have answers to questions about their personal information, with a dedicated website and call center. We will also continue to support the efforts of law enforcement and to work with leading security experts to improve. Finally, we are devoting the resources necessary to phase out Starwood systems and accelerate the ongoing security enhancements to our network.”

Maybe I’m too passive about this stuff, but I don’t put much thought into these data breaches. I feel like if I did, I’d spend 24/7 paranoid, given how much information we give out to various companies on a day-by-day basis. Short of moving to a deserted island and cutting off contact with the outside world (which doesn’t seem great given that I blog for a living), I feel like I’ll be exposed to this stuff no matter what.

So I choose not to think about, and in the event that I do ever have issues with a credit card stolen, my identity stolen, etc., I’ll deal with it as need be. I’d rather it be annoying to deal with for a short period of time, than this be something I constantly think about my entire life.

The beauty of credit cards is that you have fraud protection, so in the event that your information is compromised, you’re typically not on the hook. And I’m not too worried about any hackers figuring out my SPG profile preferences otherwise.

So yeah, obviously this isn’t great, but every time I hear about one of these I just kinda go ¯_(ツ)_/¯.

What’s your take on these data breaches? Immediate panic, or just “it is what it is?”

More discussion »

Support OMAAT

Conversations (25)

The comments on this page have not been provided, reviewed, approved or otherwise endorsed by any advertiser, and it is not an advertiser's responsibility to ensure posts and/or questions are answered.

Comment as a member

Membership is free and takes no more information than commenting as a guest. Earn status points for good contributions, and see fewer ads as your status grows.

Loading comments…

Recent Comments

The latest from the OMAAT community.

Azamaraal Diamond

December 1, 2018, 6:46 am

Not the Conrad - structures on the beach and facing the wrong direction (looks like sunset to me). Got hacked last month at start of holiday. Devastating as it took AMEX almost a month to get me a replacement card and the web site no longer shows the new card and they can't fix it. Probably from BA hack in the summer. BA, Starriott, and the rest should be on the hook for compensation for anyone whose account is hacked. Minimum $100 per incident plus covering any losses.

‼ 0

Bob Guest

November 30, 2018, 11:05 pm

Having worked in IT security for the last 2 decades I can say that yes can't be paranoid about this kind of stuff because if the hackers want in they will likely find a way in. Hoooowever, having worked and studied up on many of these companies it IS their responsibility to at least try to secure their infrastructure. These billion dollar corporations almost always refuses to spend a few extra million to shore up their security. They never react until something like this happens. Part of it is cheapness and part of it is that those higher up in charge is almost always oblivious at how technology works and won't make the informed decision because why on earth would an old bald fart exec want to listen to geeks tell them what to do. While these companies will never block any hacker 100% there are many many ways to make the hacking really difficult and time consuming. We shouldn't hear about major breaches more often than once every few years. Look at UAL and their pathetic understanding of security. They have the nerve to call their website secure and multi factor enabled when all they are doing is ask you a 2nd login question (with static answers no less making them even less secure than before they implemented that nonsense). Or starbucks whose app used to stored credentials in clear text on the phone. They refused to listened to the security community until the day after target got hacked and someone wrote in a newspaper article starbucks is next because of their app. And then all of a sudden starbucks patched their app. How secure could that rush job have been?? Bottom line, many many non tech centric companies make laughable effort at security. Its like locking your house with a broomstick and hoping thats sufficient. They deserve what they get.

‼ 0

Tim Guest

November 30, 2018, 7:49 pm

I took part in the CX data breach lawsuit, I'm just waiting for customers to get angry enough to launch one on Marriot, personally if I had gotten angry with Marriot I would have died of a brain aneurysm ever since the merger began. But I choose to pick my battles and walk away from the program.

‼ 0

FMLAX Diamond

November 30, 2018, 4:01 pm

Lucky, isn't your headline photo from the Conrad Maldives?

‼ 0

mangoMan Member

November 30, 2018, 3:03 pm

Not caring whether they get your CC number and make unauthorized charges is one thing. Getting enough personal info such that they can steal your identity is another, and something one should be concerned about. If they start getting credit cards, bank accounts, etc in your name, it's your credit rating that goes in the toilet, and can be a real PITA to fix.

‼ 0