The Marriott Credit Breach and What You Need to Know

Marriot reported a credit breach that involved unauthorized access to the database used for reservations at its Starwood properties on November 30, 2018. Marriott reported that the data breach may have compromised the personal information of up to 500 million people. It also reported that the database has been hacked since 2014. Starwood properties include more than 6,700 Sheraton, Westin, Le Meridien, St. Regis and other hotels in more than 70 countries around the globe. Here’s what you need to know if you stayed at a Starwood property in the last four years.

Marriott Credit Breach Details

According to Marriott’s report, here’s how the data breach breaks down:

Who may be affected: anyone who stayed at a Starwood property between 2014 to September 10, 2018.

Properties affected:

W Hotels
Regis
Sheraton Hotels & Resorts
Westin Hotels & Resorts
Element Hotels
Aloft Hotels
The Luxury Collection
Tribute Portfolio
Le Méridien Hotels & Resorts
Four Points by Sheraton and Design Hotels
Starwood branded timeshare properties

Note that Marriott hotels were not affected. Marriott uses a separate reservation database for its Marriott properties.

Get everything you need to master your credit today.

Get started for free

Why September 18, 2018? An internal security tool alerted Marriott to a potential hack on September 18, 2018. Marriott took quick action to stop the hack.

The database affected by the security breach has information on 500 million guests. Marriott reported that for 327 million of those guests, compromised data may include:

Name
Mailing address
Phone number
Email address
Passport numbers
Starwood Preferred Guest (SPG) account information
Date of birth
Gender

It also includes less-critical data, such as arrival and departure information, reservation date, and communication preferences. And it may include credit card numbers and payment card expiration dates. At this time, Marriott cannot confirm that the payment card numbers were compromised, but it also cannot guarantee that the numbers were not compromised.

For all guest, name, and in some cases, mailing and email address, were likely taken by the hackers.

What Marriott Is Doing

If you were affected by the data breach, Marriott is offering the following:

Breach website and call support. The number for the U.S. is 877-273-9481. Numbers for other countries can be found on the website.
Email notifications to all affected guests starting November 30, 2018, which will come from starwoodhotels@email-marriott.com.
Free WebWatcher WebWatcher monitors websites where users share personal information and alerts users personal information is found. If you were affected, visit info.starwoodhotels.com to enroll.
For U.S. residents, the WebWatcher enrollment also includes fraud consultation services and reimbursement coverage free of charge.

What to Do if the Data Breach Affects You

If you think your payment card number was compromised:

Check your credit reports and watch for changes in your score. You can check your credit report for free each year at annualcreditreport.com. You can also get your free Experian credit score right here at credit.com. Credit.com will update your score every 14 days, which can help you monitor for sudden changes outside of your free annual reports.
Consider a freeze on your credit reports if you think your payment information was taken.
Call your credit card and/or debit card provider and ask for a new card with a new card number.
Watch your monthly statements and report any suspicious transactions on your credit card or debit card to card company within 60 days of receiving your statement.
Enroll in a credit monitoring service.

Also:

Change passwords on personal accounts, including web-based shopping accounts, and especially on your SPG account. Enable two-factor authentication if you haven’t already and it’s an available option.
Watch your email inbox. Watch for alerts that your password has been changed or requests to change a password. And never click on a link in an email, especially a link regarding this breach from any email other than starwoodhotels@email-marriott.com.
Monitor your SPG account for unusual activityif you have one. While Marriott has not found that these accounts have been accessed by the hackers, it still advises the users monitor their accounts.