Skip to Content

How to check if you’re affected by the Marriott mega data breach

November 30, 2018

The Marriott hotel group says information belonging to up to 500 million customers of its Starwood hotels may have been compromised. That would make it one of the biggest data thefts ever.
The news: After receiving a security alert in September, Marriott launched an investigation that revealed hackers had gained access to Starwood Hotels’ guest reservation database. The company is still trying to work out the full extent of the breach, which it says stretches back to 2014. Starwood includes the St. Regis, Westin, Sheraton, and W hotels.
The impact (so far): The hackers, who copied and encrypted customer data, took steps to remove it, but it’s not clear yet what exactly was extracted. Marriott says the hackers compromised a wide range of data from some 327 million customers, including things like date of birth, e-mail addresses, passport numbers, and loyalty account information. In the case of the other guests, the data compromised appears to be limited to things like names and e-mail addresses.

In some cases—Marriott hasn’t yet said how many—the intruders targeted payment card numbers and card expiration dates. The hotel chain says it had encrypted such data, but it can’t be sure the intruders don’t have the “components” needed to decrypt the numbers—which is deeply worrying and raises even more questions about the state of the Marriott group’s cyber defenses.
The response (so far): Marriott has put up a website with more information about the breach and opened a call center to handle questions from customers. It’s also sending out e-mails to people whose data may have been affected if it has their address in its database, and offering a free year’s subscription to an identity-theft protection service. Given that payment card details are involved, people should also check in with their card issuers if they fear that data may be at risk.

Marriott will no doubt be hoping a swift response to its breach will help limit possible legal action and fines under provisions like Europe’s General Data Protection Regulation. But if it turns out to have had lax controls on that data, it could still end up in legal hot water.

Correction: an earlier version of this story said the breach affected 500,000 customers instead of 500 million.

Deep Dive


child outside a destroyed residential building in Kiev
child outside a destroyed residential building in Kiev

Russia hacked an American satellite company one hour before the Ukraine invasion

The attack on Viasat showcases cyber’s emerging role in modern warfare.

hacked telecom concept
hacked telecom concept

Chinese hackers exploited years-old software flaws to break into telecom giants

A multi-year hacking campaign shows how dangerous old flaws can linger for years.

stock image of robots in a car plant
stock image of robots in a car plant

Transforming the automotive supply chain for the 21st century

Cloud-based tech solutions are helping manufacturers manage a new ecosystem of suppliers with greater agility and resilience.

inflection point post-NSO concept
inflection point post-NSO concept

The hacking industry faces the end of an era

But even if NSO Group is no more, there are plenty of rivals who will rush in to take its place. And the same old problems haven’t gone away.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at with a list of newsletters you’d like to receive.