Personal data including credit card details, passport numbers and the dates of birth of up to 500 million people has been stolen in a “colossal” hack of Marriott International, the parent company of hotel chains including W, Westin, Le Méridien and Sheraton.
The company said it first became aware of a security breach in early September, but that further investigation revealed unauthorised access to the guest reservation database dating back to 2014.
The extent of the compromised data varied by guest, Marriott said, but it included names, mailing addresses, phone numbers, email addresses, passport numbers, Starwood Preferred Guest account information, dates of birth, gender, arrival and departure information, reservation dates, and communication preferences, as well as card numbers and expiration dates.
Although credit card information was encrypted, Marriott has not been able to rule out the possibility that the encryption keys were also stolen.
The company said reservations at its Starwood properties, which include the Sheraton Grand Park Lane and Le Méridien Piccadilly in London and the Sheraton Grand in Edinburgh, had been affected by the incident.
The breach was first spotted in the Starwood guest reservation database in the US on 8 September. That discovery prompted further investigation, which uncovered “unauthorised access to the Starwood network since 2014”.
The company did not give a date for when it learned that “an unauthorised party had copied and encrypted information, and took steps towards removing it”, saying only that it happened recently. It said it confirmed the breach on 19 November.
Arne Sorenson, the president and chief executive of Marriott International, said: “We deeply regret this incident happened. We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”
The Maryland-based company said law enforcement agencies were investigating.
Tom van de Wiele, a consultant at the information security firm F-Secure, said: “The most disappointing part of this hack is the fact that the amount of data stolen is one of the bigger ones of the last few years and further made worse by the fact that the compromise had been going on for at least four years.
“This indicates that as far as security monitoring and being able to respond in a timely and adequate fashion, Marriott had severe challenges being able to live up to its mission statement of keeping customer data safe.”
The consumer rights organisation Which? said the data breach was “on a colossal scale and [would] be of great concern to Marriott customers”.
“It is vital that Marriott provides clear information on what has happened and helps anyone who has been negatively impacted,” said Which?, warning Marriott customers to “be wary of emails regarding the breach, as scammers may try and take advantage of it”.
Ilia Kolochenko, the chief executiveof the web security company High-Tech Bridge, said: “Legal ramifications for Marriott and its subsidiaries can be tremendous, from harsh financial penalties from authorities in many countries to individual and class-action lawsuits from the victims.”
The data breach is likely to attract the attention of European regulators, both for the scale of the problem, and the delay in reporting it to the public. The general data protection regulation (GDPR) allows for fines for data breaches of up to 4% of annual turnover; in Marriott’s case, that would imply a maximum fine of £117m.
Kolochenko added: “In the past two years many companies were over-concerned to comply with GDPR on paper, ignoring practical security requirements due to limited budget and resources. Management is often satisfied with a formalistic approach to compliance, ignoring the practical side of cybersecurity and privacy.”
Starwood was bought by Marriott in 2016.
