This is undoubtedly one of the biggest data hacks to date, far from Yahoo and its 3 billion accounts attacked in August 2013, but ahead of the 427 million passwords stolen from the MySpace social network: Marriott revealed on Friday hacking into a database which may contain the details of almost 500 million guests who have stayed at Starwood Group hotels (editor's note: the Starwood Group is one of the world's leading hotel chains): acquired by Marriott in 2016). Alerted on 8 September by an internal security tool to an attempt to access the Starwood hotel reservations database, the group commissioned security experts to investigate, revealing unauthorised access to the Starwood network since 2014.
In fact, for approximately 327 million of customers affected In this hack, the information includes a combination of name, postal address, telephone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date and communication preferences. For some, payment card numbers and expiry dates may also have been stolen. While the system encrypts payment card numbers and requires two elements to decrypt them, Marriott does not rule out the possibility that both have been taken. For the remaining 170 million customers, information is limited to name, and sometimes postal or e-mail addresses.
" We deeply regret this incidentsaid Arne Sorenson, CEO of Marriott. We have fallen short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests and use the lessons learned to move forward. " Among the measures takenIn addition, the group has set up a website (info.starwoodhotels.com) and a call centre, open 7 days a week and available in several languages, to answer customers' questions about the incident. The group has also begun sending emails to customers affected by the hacking. Finally, Marriott is offering a free one-year subscription to WebWatcher, which monitors websites where personal information is shared and generates an alert to the consumer if any evidence of the consumer's personal information is found.
