A massive data breach may have exposed up to 500 million Marriott guests' personal information

Another day, another data breach putting millions of people's personal information at risk.

Marriott International said Friday that it had discovered a data breach of the online system used to make reservations at its Starwood hotels; Starwood is a Marriott subsidiary that includes chains like Westin and Sheraton. "Unauthorized access" to the database was discovered going back to 2014, and the system includes information on up to 500 million guests.

Information that could have been exposed includes guests' names, mailing addresses, phone numbers, email addresses, passport numbers, dates of birth, genders, arrival and departure information, reservation dates, and even credit card information.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

Marriott says it has reported the breach to law enforcement and opened a call center to take questions from concerned customers. "Marriott deeply regrets this incident happened," the company added.

If the 500 million number is right, this would be one of the largest data breaches in history, per NBC News. In addition to the extraordinary size and scale of the breach, The Verge points out that it's unusual for a company like Marriott to not uncover something like this for four years. But data breaches are not uncommon in the hotel industry. In 2017, Hilton Hotels was fined after two breaches on 363,000 accounts, per BBC News, and Trump Hotels were also hacked that year via a third party reservation system for the third time. Industry research published in Hospitality Tech in 2017 found that 74 percent of hotels don't have breach protection, with the trade magazine observing that, despite it being "a favorite for hackers," the hotel industry is "woefully unprepared" for breaches.