Dealing With the Aftermath of the 500 Million-Guest Marriott Breach

The fallout continues, including a Congressional letter from NAFCU, following Marriott International’s announcement of a security breach that compromised the personal data of 500 million guests staying at Starwood properties.

The Bethesda, Md.-based chain, which operates more than 6,700 properties globally, said in a Nov. 30 statement it is investigating a data security incident involving the Starwood database, which they discovered on September 8, 2018 but dates back to 2014.

For approximately 327 million guests the information included some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. For some, the data also included payment card numbers and expiration dates. Although the payment card numbers were encrypted using the Advanced Encryption Standard, Marriott has not been able to rule out the possibility that both components needed to decrypt the card numbers were taken.