What You Need To Know About Marriott's Starwood Data Breach

Hotel chain Marriott International Inc MAR confirmed Friday it has been a victim of a data security breach involving its Starwood guest reservation database.

What Happened

Marriott said in a regulatory filing it first became aware of a potential data breach Sept. 8, when an internal security tool flagged an attempt to access the reservation database. After tasking external security experts to study its security system, the company was made aware unauthorized access to its reservation system has been occurring since 2014.

The unauthorized party managed to copy and encrypt information which may include information on 327 million guests. The information includes some combination of name, address, phone number, e-mail address, passport number, date of birth, among other pieces of information.

Why It's Important

The total number whose information was potentially exposed is as high as 500 million guests.

The company said the unauthorized party may have gathered payment card numbers and expiration dates "for some" of its clients. While this data is typically encrypted in Marriott's system and requires two components to decrypt, the company says it "has not been able to rule out the possibility that both were taken."

What's Next

Marriott said it will continue working with law enforcement and security experts and simultaneously phasing out the Starwood systems while accelerating ongoing initiatives to enhance the security of its network.

"We fell short of what our guests deserve and what we expect of ourselves," said Arne Sorenson, Marriott's President and CEO. "We are doing everything we can to support our guests, and using lessons learned to be better moving forward."

Shares of Marriott were trading lower by nearly 5 percent ahead of Friday's market open.

Related Links:

Study: Stocks Fall An Average Of 5% After Data Breach

Report: Google Tried To Cover Up A Data Breach

Photo credit: Sallicio [Public domain], via Wikimedia Commons