Massive, extended data breach within Marriott’s hotel empire

A security breach inside Marriott’s worldwide hotel empire has compromised the information of as many as 500 million guests, exposing in some cases credit card numbers, passport numbers and birthdates, the company said Friday.

Alarming security analysts, Marriott said that unauthorized access to data at the hotels, once run by Starwood, has been taking place since 2014.

It may be among the largest data breaches on record. Last year’s startling Equifax hack affected more than 145 million people.

The affected hotel brands operated by Starwood before it was acquired by Marriott in 2016 include W Hotels, St. Regis, Sheraton, Westin, Element, Aloft, The Luxury Collection, Le Meridien and Four Points. Starwood branded timeshare properties are also included.

None of the Marriott-branded chains are threatened.

Credit card numbers and expiration dates of some guests

“We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”

may have been taken, according to the company. For as many as two-thirds of those affected, data exposed could include mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date and communication preferences. For some guests, the information was limited to name and sometimes other data such as mailing address, email address or other information.

“We fell short of what our guests deserve and what we expect of ourselves,” CEO Arne Sorenson said in a prepared statement. “We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”

Email notifications for those who may have been affected begin rolling out Friday.

While the breach affected “approximately 500 million guests” who made a reservation at one of the affected hotels, some of those records could include a single person who booked multiple stays.

Asked for more details on the 500 million number, Marriott spokesman Jeff Flaherty said Friday that the company has not finished identifying duplicate information in the database.

When the merger was first announced in 2015, Starwood had 21 million people in its loyalty program.

The company manages more than 6,700 properties across the globe. Most are in North America.

While the first impulse for those potentially affected by the breach could be to check credit cards, security experts say other information in the database could be more damaging.

“The names, addresses, passport numbers and other sensitive personal information that was exposed is of greater concern than the payment info, which was encrypted,” said analyst Ted Rossman of Creditcards.com.