Hotel chain Marriott admits data breach of 500 million guests' information
PUBLISHED: 16:43 30 November 2018 | UPDATED: 16:43 30 November 2018
The personal information of more than 500 million guests of the hotel chain Marriott may have been exposed by breaches of a reservation database that began in 2014, the company has said.
The company said reservations at its luxury Starwood properties – which include the Park Lane Sheraton Grand, Westbury Mayfair and Le Meridien Piccadilly – had been affected by the “data security incident”.
The firm said the breached database contains the information of up to half a billion guests, but work to find out more was continuing. Marriott no longer runs any hotels in Norfolk or Suffolk - its nearest hotel is the University Arms Hotel in Cambridge, or the Huntingdon Marriott Hotel.
The database stored information including passport numbers, dates of births, names, addresses and phone numbers for 327 million guests.
Payment card numbers and expiration dates were also stored for some.
The breach was spotted in the Starwood guest reservation database in the US on September 8 and the company “discovered that an unauthorised party had copied and encrypted information, and took steps towards removing it”, a statement said.
Security experts determined there “had been unauthorised access to the Starwood network since 2014”, it added.
Researchers decrypted the information and determined its contents were from the Starwood reservation database on November 19, said Marriott, which bought Starwood in 2016.
Marriott president and chief executive Arne Sorenson said: “We deeply regret this incident happened.
“We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”
The Maryland-based firm said law enforcement agencies are investigating.
Payment card numbers are encrypted using a method that requires two components to break it, a statement said.
“Marriott has not been able to rule out the possibility that both were taken,” it added.
The Information Commissioner’s Office (ICO) has began making inquiries over the breach and has the power to impose large fines.
“We have received a data breach report from Marriott Hotels involving its Starwood hotels and will be making inquiries,” a spokeswoman said.
“If anyone has concerns about how their data has been handled they can report these concerns to us.”
Facebook was fined £500,000 over the Cambridge Analytica scandal which saw an estimated 87 million users’ data breached, but the tech giant has mounted an appeal.