# Massive data breach at Marriott; up to 500 million people affected **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [November 30, 2018, 1:37pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333 "2018-11-30T13:37:54Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Snowboarder\_Bo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowboarder_bo/32/229_2.png) [@Snowboarder\_Bo](https://boards.straightdope.com/u/Snowboarder_Bo)\ **Post date:** [November 30, 2018, 1:37pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/1 "2018-11-30T13:37:54Z")
[AP story](https://apnews.com/d496fce7a77347d6aa058470d38a69bc); AFAIK it’s still developing so new details may be added or emerge later. > [@](#): > > The information of as many as 500 million people staying at Starwood hotels has been compromised and Marriott says it’s uncovered unauthorized access that’s been taking place within its Starwood network since 2014. > > The company said Friday that credit card numbers and expiration dates of some guests may have been taken. For about 327 million people, the information exposed includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date and communication preferences. For some guests, the information was limited to name and sometimes other data such as mailing address, email address or other information. > > Marriott said that there was a breach of its database in September, which had guest information related to reservations at Starwood properties on or before Sept. 10. > [@](#): > > Shares of Marriott tumbled 6 percent before the opening bell. ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [November 30, 2018, 3:19pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/2 "2018-11-30T15:19:07Z")
I don’t understand why there isn’t a law stating that a company must pay $1000 to each person whose data gets stolen. Seems like the lack of security these companies employ would immediately become better when being faced with $500 billion in fines. ---
**Author:** ![Defensive\_Indifference](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/defensive_indifference/32/6502_2.png) [@Defensive\_Indifference](https://boards.straightdope.com/u/Defensive_Indifference)\ **Post date:** [November 30, 2018, 3:25pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/3 "2018-11-30T15:25:15Z")
> [@Slash1972](#): > > I don’t understand why there isn’t a law stating that a company must pay $1000 to each person whose data gets stolen. > > Seems like the lack of security these companies employ would immediately become better when being faced with $500 billion in fines. The [General Data Protection Regulation (GDPR)](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation) in the EU provides for fines of up to 4% of an enterprise’s global revenue if the enterprise has a breach that’s the result of negligence. That gets a lot of people’s attention. ---
**Author:** ![bobot](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bobot/32/21622_2.png) [@bobot](https://boards.straightdope.com/u/bobot)\ **Post date:** [November 30, 2018, 3:33pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/4 "2018-11-30T15:33:31Z")
Man, the numbers get more staggering every time this happens. 500 million people. Jaysus. ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [November 30, 2018, 3:56pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/5 "2018-11-30T15:56:39Z")
> [@bobot](#): > > Man, the numbers get more staggering every time this happens. 500 million people. Jaysus. Eh, boss? ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [November 30, 2018, 4:14pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/6 "2018-11-30T16:14:00Z")
Can that number really be right? I’ve never even heard of Starwood Hotels and half a billion unique individuals have stayed there? ETA: oh, I see Starwood comprises a number of brands including Westin and Sheraton. Still seems like an awful lot of guests. ---
**Author:** ![Roderick\_Femm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/roderick_femm/32/14875_2.png) [@Roderick\_Femm](https://boards.straightdope.com/u/Roderick_Femm)\ **Post date:** [November 30, 2018, 4:58pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/7 "2018-11-30T16:58:58Z")
Plus those are mostly high-end hotels, which makes their customers into more valuable targets. I heard on TV this morning that they have set up a website and phone number to attempt to help the potential victims. I am one of their customers and it would be helpful to know precise details about what information was taken and when. I don’t expect them to be that forthcoming, however. ---
**Author:** ![blondebear](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/blondebear/32/1022_2.png) [@blondebear](https://boards.straightdope.com/u/blondebear)\ **Post date:** [November 30, 2018, 5:05pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/8 "2018-11-30T17:05:02Z")
I was a Marriott Rewards Member who was “upgraded” to Starwood’s “Preferred Guest” program, so it’s possible my records might be part of the breach. No email from them yet. I guess they’ll offer a year of credit monitoring…oh boy, thanks a lot. ---
**Author:** ![Eyebrows\_0f\_Doom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eyebrows_0f_doom/32/3119_2.png) [@Eyebrows\_0f\_Doom](https://boards.straightdope.com/u/Eyebrows_0f_Doom)\ **Post date:** [November 30, 2018, 5:05pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/9 "2018-11-30T17:05:24Z")
> [@](#): > > None of the Marriott-branded chains are threatened. Glad whenever I stay in a hotel it’s a Marriot Residence Inn! > [@pulykamell](#): > > Can that number really be right? I’ve never even heard of Starwood Hotels and half a billion unique individuals have stayed there? > > ETA: oh, I see Starwood comprises a number of brands including Westin and Sheraton. Still seems like an awful lot of guests. There is no way that figure can be accurate. 15% of the \*\*entire world \*\*has stayed at a Starwood branded hotel (but not including any Marriotts?) I doubt it. My guess is that is not unique guests, but includes all repeat customers. ---
**Author:** ![wguy123](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wguy123/32/3161_2.png) [@wguy123](https://boards.straightdope.com/u/wguy123)\ **Post date:** [November 30, 2018, 5:39pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/10 "2018-11-30T17:39:02Z")
This is a good reminder of why everyone should lock their credit with all the agencies. ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [November 30, 2018, 5:50pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/11 "2018-11-30T17:50:38Z")
> [@Slash1972](#): > > I don’t understand why there isn’t a law stating that a company must pay $1000 to each person whose data gets stolen. > > Seems like the lack of security these companies employ would immediately become better when being faced with $500 billion in fines. Yep-Nothing makes a company more secure than bankrupting it into oblivion. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [November 30, 2018, 6:50pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/12 "2018-11-30T18:50:23Z")
> [@Eyebrows\_0f\_Doom](#): > > My guess is that is not unique guests, but includes all repeat customers. That’s the only way the number makes any kind of sense to me. ---
**Author:** ![G0sp3l](https://avatars.discourse-cdn.com/v4/letter/g/c68b51/32.png) [@G0sp3l](https://boards.straightdope.com/u/G0sp3l)\ **Post date:** [November 30, 2018, 11:20pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/13 "2018-11-30T23:20:37Z")
First, it is hard as hell to secure a network. Impossible even. Causes me some sleepless nights worrying. Second, hopefully my wife doesn’t get a hold of my history! 🙂 ---
**Author:** ![Tom\_Tildrum](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@Tom\_Tildrum](https://boards.straightdope.com/u/Tom_Tildrum)\ **Post date:** [November 30, 2018, 11:26pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/14 "2018-11-30T23:26:41Z")
Does the breach include movie-rental data? Asking for a friend. ---
**Author:** ![Snowboarder\_Bo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowboarder_bo/32/229_2.png) [@Snowboarder\_Bo](https://boards.straightdope.com/u/Snowboarder_Bo)\ **Post date:** [November 30, 2018, 11:30pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/15 "2018-11-30T23:30:27Z")
The AP has updated the article I linked in the OP: > [@](#): > > Hackers stole information on as many as 500 million guests of the Marriott hotel empire over four years, obtaining credit card and passport numbers and other personal data, the company said Friday as it acknowledged one of the largest security breaches in history. > > The full scope of the failure was not immediately clear. Marriott was trying to determine if the records included duplicates, such as a single person staying multiple times. > > The affected hotel brands were operated by Starwood before it was acquired by Marriott in 2016. They include W Hotels, St. Regis, Sheraton, Westin, Element, Aloft, The Luxury Collection, Le Méridien and Four Points. Starwood-branded timeshare properties were also affected. None of the Marriott-branded chains were threatened. They stole data for _four years_ before anyone noticed. So yeah, prolly is actually 500 million people, or near enough. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [November 30, 2018, 11:36pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/16 "2018-11-30T23:36:53Z")
> [@Snowboarder\_Bo](#): > > The AP has updated the article I linked in the OP:They stole data for _four years_ before anyone noticed. So yeah, prolly is actually 500 million people, or near enough. See, I assumed as much. I actually assumed _all_ their historical guest data, so not just the past four years, but for as long as they’ve been storing data. So that makes it even _more_ unlikely to me. 15% of the world has stayed at one of these hotels in the past four years? Really? I mean, I have a comfortable middle class lifestyle, and I’ve never stayed at one of those; I’m certain my parents have never stayed at one of those. It just doesn’t seem at all plausible to me. Half a billion unique guests? Really? ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [November 30, 2018, 11:54pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/17 "2018-11-30T23:54:27Z")
> [@AP article](#): > > Hackers stole information on as many as 500 million guests of the Marriott hotel empire over four years > [@Snowboarder\_Bo](#): > > The AP has updated the article I linked in the OP:They stole data for _four years_ before anyone noticed. So yeah, prolly is actually 500 million people, or near enough. Not necessarily. The way it reads it can also be taken to mean hackers got into the system which had four years worth of guest’s info, maybe they started using a new system in 2014? ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [December 1, 2018, 12:02am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/18 "2018-12-01T00:02:27Z")
Note that Marriott is a separate (still secure (for now)) system. It’s only the Starwood program. I use Marriott a lot, but I don’t think I’ve used my Starwood program this century. ---
**Author:** ![Snowboarder\_Bo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowboarder_bo/32/229_2.png) [@Snowboarder\_Bo](https://boards.straightdope.com/u/Snowboarder_Bo)\ **Post date:** [December 1, 2018, 1:30am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/19 "2018-12-01T01:30:09Z")
> [@pulykamell](#): > > See, I assumed as much. I actually assumed _all_ their historical guest data, so not just the past four years, but for as long as they’ve been storing data. So that makes it even _more_ unlikely to me. 15% of the world has stayed at one of these hotels in the past four years? Really? I mean, I have a comfortable middle class lifestyle, and I’ve never stayed at one of those; I’m certain my parents have never stayed at one of those. It just doesn’t seem at all plausible to me. Half a billion unique guests? Really? Why not? About 7.5% of the US (by numbers) visits Las Vegas every year. In four years, that would be nearly 172 million people, and that’s just in this one city with a little under 150,000 hotel rooms. How many rooms do you think Starwood has worldwide, with all those brands? ---
**Author:** ![JohnT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnt/32/15048_2.png) [@JohnT](https://boards.straightdope.com/u/JohnT)\ **Post date:** [December 1, 2018, 2:18am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/20 "2018-12-01T02:18:00Z")
There are 339,000 Starwood hotel rooms worldwide: > **[Starwood Hotels and Resorts hotel rooms worldwide 2016 | Statista](https://www.statista.com/statistics/247310/number-of-starwood-hotels-and-resorts-hotel-rooms-worldwide/)** > > This statistic shows the number of Starwood Hotels and Resorts hotel rooms worldwide from 2009 to 2016. 500,000,000/(4\*365) = 342,465 Numbers indicate to me that they stole the room records, records of who stayed in each of their rooms for _four straight years_. [Next page](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333.md?page=2)