Marriot reported a credit breach that involved unauthorized access to the database used for reservations at its Starwood properties on November 30, 2018. Marriott reported that the data breach may have compromised the personal information of up to 500 million people. It also reported that the database has been hacked since 2014. Starwood properties include more than 6,700 Sheraton, Westin, Le Meridien, St. Regis and other hotels in more than 70 countries around the globe. Here’s what you need to know if you stayed at a Starwood property in the last four years.
Marriott Credit Breach Details
According to Marriott’s report, here’s how the data breach breaks down:
Who may be affected: anyone who stayed at a Starwood property between 2014 to September 10, 2018.
- W Hotels
- Sheraton Hotels & Resorts
- Westin Hotels & Resorts
- Element Hotels
- Aloft Hotels
- The Luxury Collection
- Tribute Portfolio
- Le Méridien Hotels & Resorts
- Four Points by Sheraton and Design Hotels
- Starwood branded timeshare properties
Note that Marriott hotels were not affected. Marriott uses a separate reservation database for its Marriott properties.
Why September 18, 2018? An internal security tool alerted Marriott to a potential hack on September 18, 2018. Marriott took quick action to stop the hack.
The database affected by the security breach has information on 500 million guests. Marriott reported that for 327 million of those guests, compromised data may include:
- Mailing address
- Phone number
- Email address
- Passport numbers
- Starwood Preferred Guest (SPG) account information
- Date of birth
It also includes less-critical data, such as arrival and departure information, reservation date, and communication preferences. And it may include credit card numbers and payment card expiration dates. At this time, Marriott cannot confirm that the payment card numbers were compromised, but it also cannot guarantee that the numbers were not compromised.
For all guest, name, and in some cases, mailing and email address, were likely taken by the hackers.
What Marriott Is Doing
If you were affected by the data breach, Marriott is offering the following:
- Breach website and call support. The number for the U.S. is 877-273-9481. Numbers for other countries can be found on the website.
- Email notifications to all affected guests starting November 30, 2018, which will come from firstname.lastname@example.org.
- Free WebWatcher WebWatcher monitors websites where users share personal information and alerts users personal information is found. If you were affected, visit info.starwoodhotels.com to enroll.
- For U.S. residents, the WebWatcher enrollment also includes fraud consultation services and reimbursement coverage free of charge.
What to Do if the Data Breach Affects You
If you think your payment card number was compromised:
- Check your credit reports and watch for changes in your score. You can check your credit report for free each year at annualcreditreport.com. You can also get your free Experian credit score right here at credit.com. Credit.com will update your score every 14 days, which can help you monitor for sudden changes outside of your free annual reports.
- Consider a freeze on your credit reports if you think your payment information was taken.
- Call your credit card and/or debit card provider and ask for a new card with a new card number.
- Watch your monthly statements and report any suspicious transactions on your credit card or debit card to card company within 60 days of receiving your statement.
- Enroll in a credit monitoring service.
- Change passwords on personal accounts, including web-based shopping accounts, and especially on your SPG account. Enable two-factor authentication if you haven’t already and it’s an available option.
- Watch your email inbox. Watch for alerts that your password has been changed or requests to change a password. And never click on a link in an email, especially a link regarding this breach from any email other than email@example.com.
- Monitor your SPG account for unusual activityif you have one. While Marriott has not found that these accounts have been accessed by the hackers, it still advises the users monitor their accounts.
One Step at a Time
Perhaps the most important step you can take is to not panic. Simply follow the practical steps outlined here and take things one step at a time.