# Massive data breach at Marriott; up to 500 million people affected **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [November 30, 2018, 1:37pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333 "2018-11-30T13:37:54Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [December 1, 2018, 7:08am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/21 "2018-12-01T07:08:06Z")
> [@JohnT](#): > > There are 339,000 Starwood hotel rooms worldwide: > > [Starwood Hotels and Resorts hotel rooms worldwide 2016 | Statista](https://www.statista.com/statistics/247310/number-of-starwood-hotels-and-resorts-hotel-rooms-worldwide/) > > 500,000,000/(4\*365) = 342,465 > > Numbers indicate to me that they stole the room records, records of who stayed in each of their rooms for _four straight years_. That would make somewhat more sense. If the 500 million number is correct, given there are 339,000 Starwood hotel rooms available, for there to be 500 million unique guests would mean that every Starwood hotel room would have to be booked every single day, and every visitor is a unique visitor who stayed one day. (That would bring us to about 495 million unique visitors.) Now, does that pass the sniff test? Of course not! ---
**Author:** ![JohnT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnt/32/15048_2.png) [@JohnT](https://boards.straightdope.com/u/JohnT)\ **Post date:** [December 1, 2018, 7:20am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/22 "2018-12-01T07:20:23Z")
> [@pulykamell](#): > > That would make somewhat more sense. > > If the 500 million number is correct, given there are 339,000 Starwood hotel rooms available, for there to be 500 million unique guests would mean that every Starwood hotel room would have to be booked every single day, and every visitor is a unique visitor who stayed one day. (That would bring us to about 495 million unique visitors.) > > Now, does that pass the sniff test? Of course not! Naw, you’re overthinking this. 500M is likely a rounded number giving the high range of what they may have lost. However, while reporting this they also don’t want to inadvertently give put other info such as occupancy rates, unique visitors, etc, so they probably just did my calculation “Uh, if we lost 4 years of daily data and we have 135k rooms… you’re telling me up to a half a billion records were hacked?” ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [December 1, 2018, 7:20am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/23 "2018-12-01T07:20:47Z")
If you want to come up with a reasonable upper bound, you can take the occupancy rate and average length of stay in mind. Looks like numbers generally flout around 65%, but I found Sheraton’s occupancy rate is 73%. So let’s be generous and use the higher number. Resort hotels also tend to have longer lengths of stay. But let’s be generous and pretend it’s only 2 days. So, 339,000 \* (4\*365.25) \* 0.73 / 2, gives us 180 million as a generous upper bound of unique visitors, assuming each guest only stays two days, and no guest repeat their stays in a four-year period. ---
**Author:** ![Eyebrows\_0f\_Doom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eyebrows_0f_doom/32/3119_2.png) [@Eyebrows\_0f\_Doom](https://boards.straightdope.com/u/Eyebrows_0f_Doom)\ **Post date:** [December 1, 2018, 7:21am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/24 "2018-12-01T07:21:05Z")
> [@Snowboarder\_Bo](#): > > Why not? About 7.5% of the US (by numbers) visits Las Vegas every year. In four years, that would be nearly 172 million people, and that’s just in this one city with a little under 150,000 hotel rooms. > > How many rooms do you think Starwood has worldwide, with all those brands? :dubious: 7.5% of 325,000,000 is about 24.3 million, in four years that would be just under 100 million. I don’t know where you got 172 million people from. ---
**Author:** ![Snowboarder\_Bo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowboarder_bo/32/229_2.png) [@Snowboarder\_Bo](https://boards.straightdope.com/u/Snowboarder_Bo)\ **Post date:** [December 1, 2018, 7:21am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/25 "2018-12-01T07:21:31Z")
> [@pulykamell](#): > > That would make somewhat more sense. > > If the 500 million number is correct, given there are 339,000 Starwood hotel rooms available, for there to be 500 million unique guests would mean that every Starwood hotel room would have to be booked every single day, and every visitor is a unique visitor who stayed one day. (That would bring us to about 495 million unique visitors.) > > Now, does that pass the sniff test? Of course not! If you read the quotes more closely, you’ll see that it says “as many as 500 million”. That’s just the upper limit. Based on that, I’d say that **JohnT** is prolly correct: they got every room’s daily record. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [December 1, 2018, 7:22am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/26 "2018-12-01T07:22:33Z")
> [@JohnT](#): > > Naw, you’re overthinking this. I don’t think I’m overthinking at all. I think I’m just thinking. When I heard that number on the radio this morning, the first thing I thought was, there is no way in hell that number can possibly be correct. And it very obviously isn’t. Now, do note that it does weasel with “as many as,” but to me the number looks an order of magnitude off, or close to it. ---
**Author:** ![Snowboarder\_Bo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowboarder_bo/32/229_2.png) [@Snowboarder\_Bo](https://boards.straightdope.com/u/Snowboarder_Bo)\ **Post date:** [December 1, 2018, 7:22am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/27 "2018-12-01T07:22:42Z")
> [@Eyebrows\_0f\_Doom](#): > > :dubious: 7.5% of 325,000,000 is about 24.3 million, in four years that would be just under 100 million. I don’t know where you got 172 million people from. Las vegas has 42.9 million visitors per year, not 24.3 million; I rounded up to 43 million. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [December 1, 2018, 7:23am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/28 "2018-12-01T07:23:36Z")
> [@Snowboarder\_Bo](#): > > If you read the quotes more closely, you’ll see that it says “as many as 500 million”. That’s just the upper limit. Based on that, I’d say that **JohnT** is prolly correct: they got every room’s daily record. Like I said, THAT makes sense. ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [December 1, 2018, 11:34pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/29 "2018-12-01T23:34:15Z")
> [@G0sp3l](#): > > First, it is hard as hell to secure a network. Impossible even. Causes me some sleepless nights worrying. Mostly the problem is contractors being paid to secure “90%” of the network. And I say this as a contractor. ---
**Author:** ![UnwittingAmericans](https://avatars.discourse-cdn.com/v4/letter/u/d9b06d/32.png) [@UnwittingAmericans](https://boards.straightdope.com/u/UnwittingAmericans)\ **Post date:** [December 2, 2018, 9:28am UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/30 "2018-12-02T09:28:07Z")
“500 million guests” is laughably wrong. It can’t even be 500 million check-outs. Probably either every transaction, such as taking a Coke from the minibar, that’s a transaction, or just the sum of all the rows in all the tables that got hacked. ---
**Author:** ![Snowboarder\_Bo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowboarder_bo/32/229_2.png) [@Snowboarder\_Bo](https://boards.straightdope.com/u/Snowboarder_Bo)\ **Post date:** [December 2, 2018, 9:06pm UTC](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333/31 "2018-12-02T21:06:13Z")
Maybe restaurant and bar transactions are in there too. We just don’t know a lot yet. Dunno if we ever will know that much. [Previous page](https://boards.straightdope.com/t/massive-data-breach-at-marriott-up-to-500-million-people-affected/825333.md?page=1)