500m guests affected by Marriott Hotels data breach

Marriott has announced 500 million guests' data may have been exposed during breaches in a reservation database that began in 2014.

A Marriott hotel. Picture: AP

The “data security incident” hit the system for its Starwood portfolio, which includes Trump Turnberry in Ayrshire as well as London’s Park Lane Sheraton Grand, Westbury Mayfair and Le Meridien Piccadilly.

Work is continuing, but the firm said the breached database contains the information of up to half a billion guests who booked before 10 September.

Donald Trump unveils the multi-million pound refurbishment of the Trump Turnberry clubhouse. The Trump Turnberry hotel is among those affected by the data breach. Picture: John Devlin

The database stored information including passport numbers, dates of births, names, addresses and phone numbers for 327 million guests.

Payment card numbers and expiration dates were also stored for some.

Marriott, which bought Starwood in 2016, is yet to establish how many UK customers have been affected.

The breach was spotted in the Starwood guest reservation database in the US on 8 September and the company “discovered that an unauthorised party had copied and encrypted information, and took steps towards removing it”, a statement said.

Security experts determined there “had been unauthorised access to the Starwood network since 2014”, it added.

Researchers decrypted the information and determined its contents were from the Starwood reservation databases on 19 November, Marriott said.

Marriott president and chief executive Arne Sorenson said: “We deeply regret this incident happened.

“We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”

The Maryland-based firm, which has hotels across the globe, said law enforcement agencies are investigating.

Payment card numbers are encrypted using a method that requires two components to break it, a statement said.

“Marriott has not been able to rule out the possibility that both were taken,” it added.

The National Crime Agency said it was making enquiries.

The Information Commissioner’s Office (ICO) has started making inquiries over the breach and has the power to impose large fines.

“We have received a data breach report from Marriott Hotels involving its Starwood hotels and will be making inquiries,” a spokeswoman said.

“We advise people who may have been affected to be vigilant and to follow advice from the ICO and National Cyber Security Centre websites about how they can protect themselves and their data online.”

Facebook was fined £500,000 over the Cambridge Analytica scandal which saw an estimated 87 million users’ data breached, but the tech giant has mounted an appeal.