New York (CNN Business) If you've stayed at a Starwood hotel in recent years, there's a good chance you've been impacted by a massive data breach that potentially exposed the personal data of about 500 million guests.

Marriott — which owns Starwood hotels such as the St. Regis and the Westin — on Friday disclosed that the Starwood guest reservation system had been hacked, in a breach dating back to 2014.

For 327 million people, Marriott says, the exposed information includes names, phone numbers, email addresses, passport numbers and dates of birth. For millions of others, credit card numbers and card expiration dates were potentially compromised. This kind of information could be used to steal your identity and open bank accounts, credit cards or loans in your name.

It's the second biggest corporate data breach in history, behind one involving Yahoo, which said last year that 3 billion accounts among several of its brands were compromised.

Marriott said it will start emailingusers who were impacted and it has set up a website with information about the breach.

In the meantime, here's what you can do to protect yourself:

Change your password

Marriott says guests should change their passwords regularly and pick ones that aren't easily guessed. For example, instead of a common phrase, choose a combination of four or more unrelated words with numbers, characters and a mix of upper and lower-case letters.

You should also have different passwords for all the services you use.

"Changing your password will just add one more roadblock to a potential hacker getting into your system," said Aaron Brantly, a cybersecurity expert at Virginia Tech.

Many websites, including social media and financial accounts, offer two-factor authentication for an added layer of security. Even if someone obtains your password, you can't access your accounts without a second piece of information, like a code texted to your phone.

Monitor your accounts for suspicious activity

Marriott recommends customers keep an eye on their Starwood Preferred Guest account for any suspicious activity. Guests should also check their bank, retirement, and brokerage accounts, as well as credit card statements to look for any unauthorized transactions.

Some experts recommend signing up for credit monitoring services or identity theft protection. A more extreme step is putting a freeze on your credit, which blocks anyone from accessing your credit reports without permission.

"Unfortunately, the reality is [these consumers] have to monitor continuously, for generally the rest of their lives," said Brantly. "These types of accounts are sold regularly on the dark web. ... You can usually buy credit card information for a couple dollars per credit card online."

Vivek Lakshman, VP of innovation at cybersecurity firm ThumbSignIn, says consumers can also enroll in services like WebWatcher -- which Marriott is providing for free for a year -- to track their exposure. These sites monitor websites where personal information is shared and alerts consumers if there's evidence of their information exposed online.

Open a separate credit card for online transactions

Yair Levy, a cybersecurity and information systems expert at Nova Southeastern University, recommends having a credit card dedicated to online shopping. This makes it easier to track transactions and spot fraudulent activity.

If that credit card is compromised, you also won't have to update automatic payments for things like bills.

Limit the information you share

Experts say not to provide information unless it's absolutely required to buy a product or service.

"Consumers should limit what they provide companies based on their need to know. Often, companies gather data that they may not need, but take if volunteered," said Marty Puranik, the CEO of Atlantic.Net, a cloud computing and hosting services provider.

For example, a travel company may ask for passport information, but it may not be required. If it is, you can ask what other forms of identification you can provide instead.

"If you give lower level information, or information that can be changed -- for example, a second credit card to verify your identity -- it is easier to change and protect that than a social security number or passport ID," he said.

But this isn't always possible. If you are traveling internationally, a company like Marriott may require a passport number.

Avoid saving credit card information on websites

Experts recommend minimizing the number of places where you store credit card information. However, this doesn't mean your data will be safe or protected -- it just helps cut down on the risk.

Another option is to use services such as PayPal, Google Pay, or Apple Pay, which let you pay for goods and services without divulging your credit card to the company you're buying from.

Be vigilant

Consumers should work under the assumption cyber criminals already have access to their information as breaches become increasingly common.

"Having a very healthy dose of skepticism moving forward is probably the best way to safeguard yourself in an era where all your information has been divulged, unfortunately," said Brantly.

Experts caution internet users to be wary of "phishing" attempts by bad actors looking to steal your data, including through bogus emails, fake links and fraudulent websites. On its informational website about the hack, Marriott reminded members the company will not ask you to provide your password by phone or email.

"Know you are consistently being exposed [and] consistently under threat -- not necessarily through any fault of your own but accidental disclosures by companies or carelessness by companies. It requires us in the modern era to be vigilant consistently," said Brantly.</s>One of the largest hotel chains in the world announced Friday that the personal information of up to 500 million guests may have been stolen after its reservations database was hacked.

Marriott International said that guests who made reservations with its Starwood properties on or before Sept. 10 may have had their information compromised. Among the hotels under the Starwood brand are Sheraton, Westin and St. Regis.

A: The database included information tied to as many as 500 million guests, Marriott said. For about 327 million of the guests, hackers had access to names, addresses, phone numbers, email addresses and passport numbers. The hackers could also see loyalty program account information, dates of birth, gender and reservation information.

The hotel said that the database also contained encrypted credit card numbers for some customers and that it can’t rule out that the hackers stole information that could decrypt and reveal those numbers.

For the remaining customers, the information stored in the database included their names and, for some, addresses, email addresses and other information, Marriott said.

Q: What should I do?

A:If you made a reservation with a Starwood hotel on or before Sept. 10, the information you shared may have been stolen, the hotel said.

Starting Friday, Marriott said it will begin sending emails on a rolling basis to affected guests who have shared their email addresses with Starwood. Marriott has cautioned customers to stay vigilant as they look for this email because malicious actors may try to pose as Marriott.

On an FAQ page, Marriott listed the official email address from which it will send the notification. The hotel said:

Marriott has also put up a dedicated website and directed customers to a cell center to ask questions.

Q: How do I sign up for fraud monitoring?

A: Marriott said it is offering customers a fraud monitoring service at no cost for one year. It said WebWatcher monitors websites where personal data is shared and alerts customers if their information is found. People can enroll in WebWatcher through Marriott’s dedicated website.

Q: What happens next?

A: Marriott has directed customers to monitor their loyalty program, Starwood Preferred Guest, for suspicious activity. Customers should also review their credit card statements and look out for unauthorized purchases, the hotel said.

Marriott said it will not ask customers to provide their password by phone or email and told guests to stay vigilant against phishing attempts in the wake of the data breach.</s>The information of as many as 500 million people staying at Starwood hotels has been compromised and Marriott says it's uncovered unauthorized access that's been taking place within its Starwood network since 2014.

The company said Friday that credit card numbers and expiration dates of some guests may have been taken. For about 327 million people, the information exposed includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date and communication preferences. For some guests, the information was limited to name and sometimes other data such as mailing address, email address or other information.

Marriott said that there was a breach of its database in September, which had guest information related to reservations at Starwood properties on or before Sept. 10.

Starwood operates hotels under the names: W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels. Starwood branded timeshare properties are also included.

Marriott International Inc. discovered through the investigation that someone copied and encrypted guest information and tried to remove it.

Marriott and Starwood merged two years ago and attempts to combine the loyalty programs for the hotels have been marred by technical difficulties.

CEO Arne Sorenson said in a prepared statement Friday that Marriott is still trying to phase out Starwood systems.

Marriott has set up a website and call center for anyone who thinks that they are at risk, and on Friday will begin sending emails to those affected.

Follow @ChiTribBusiness on Facebook and @ChiTribBiz on Twitter.</s>As many as 500 million people who made reservations at Starwood properties may have had their personal information accessed in a breach that lasted as long as four years.

The hotelier said it determined Nov. 19 that a breach had occurred involving the Starwood guest reservation database, which has information on reservations at Starwood properties made on or before Sept. 10, 2018.

Marriott said it got an alert Sept. 8 about an attempt to access the Starwood database in the U.S., and enlisted security experts to assess the situation. During the investigation, Marriott said it learned there had been unauthorized access to the Starwood network since 2014.

An unauthorized party had copied and encrypted information from the database and had taken steps towards removing it, Marriott says. The company was able to decrypt the information on Nov. 19 and found that the contents were from the Starwood guest reservation database.

More: Dunkin' Donuts says some DD Perks members' accounts may have been hit by data breach

More: USA TODAY's list of the biggest data breaches and hacks of all time

Your Money: Managing your money can be hard. Let our newsletter make it easier.

Marriott has not finished decrypting the duplicated data but says it contained information on as many as 500 million guests who made a reservation at a Starwood property. For about 327 million of them, Marriott says, the data includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences.

A breach potentially yielding that massive of a database pushes Marriott's Starwood incident into the upper echelon among the largest breaches ever. The 2013 Yahoo breach, which affected as many as 3 billion accounts, remains the largest so far. A separate subsequent Yahoo breach also hit 500 million accounts.

Among the most attention-grabbing breaches, Facebook said in October 2018 that about 30 million users potentially had personal information accessed.

Marriott faces potential legal repercussions and a major hit to its reputation, says Jeff Pollard, vice president and principal analyst at research firm Forrester. The hackers' access appears to go back four years and apparently "went undetected during the merger and subsequent consolidation efforts," he said in a statement. "Cybersecurity breaches have a long tail, and this one will lead to unanticipated costs for Marriott.”

Any guest who made a Starwood reservation, regardless of whether they are a Starwood Preferred Guest member, may have had their data involved in the breach, Marriott says. For some Starwood guests, the data may also include payment card numbers and payment card expiration dates, but the payment card numbers were encrypted, Marriott says.

Still, Marriott has not been able to rule out the possibility that the breach led to that data being accessed. For the remaining customers, the information was limited to name and possibly other data such as mailing address, email address, or other information.

Marriott has notified regulators about the breach and continues to work with law enforcement on the investigation, the company says.

“We deeply regret this incident happened,” said Marriott President and CEO Arne Sorenson said in a statement. “We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”

Marriott completed its $13 billion acquisition of Starwood Hotels and Resorts in September 2016 to make the combined company the largest hotel chain in the world with more than 5,500 hotels at the time. Marriott now has more than 6,700 hotels.

After the merger, members of the Marriott Rewards and Starwood Preferred Guest programs were able to link their accounts. However, Marriott uses a separate reservation system on a different network for Marriott hotels.

Starwood Hotels include W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels. Starwood branded timeshare properties are also included.

Marriott says it will begin Friday emailing guests whose email addresses are in the database. The company says it will provide free of charge online account monitoring software WebWatcher to guests for one year. The service reimburses fraud loss of up to $1 million. U.S. customers who use it will also get fraud consultation services and reimbursement coverage for free.

To enroll in WebWatcher and get additional information about the breach, customers can go to info.starwoodhotels.com.

Other steps Marriott recommends to guest potential hit in the breach:
•Monitor your Starwood Preferred Guest account for suspicious activity.

 

 •Change your password. Do not use easily guessed passwords or the same passwords for multiple accounts.

 

 •Review your credit card statements for unauthorized activity and immediately report any to your bank.

 

 •In the wake of data breaches, consumers should be wary of third parties attempting to gather information by deception, so-called "phishing" attempts, including through links to fake websites. Marriott will not ask you to provide your password by phone or email.

 

 •If you think you may be the victim of identity theft – or your personal data has been misused – immediately contact law enforcement and the Federal Trade Commission. On the FTC's site, it recommends consumers get a free, one-year fraud alert from one of three credit bureaus – Equifax, Experian, or TransUnion.</s>Starwood Hotels has confirmed its hotel guest database of about 500 million customers has been stolen in a data breach.

The hotel and resorts giant said in a statement filed with U.S. regulators that the “unauthorized access” to its guest database was detected on or before September 10 — but may have dated back as far as 2014.

“Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014,” said the statement. “Marriott recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it.”

Specific details of the breach remain unknown. We’ve contacted Starwood for more and will update when we hear back.

The company said hat it obtained and decrypted the database on November 19 and “determined that the contents were from the Starwood guest reservation database.”

Some 327 million records contained a guest’s name, postal address, phone number, date of birth, gender, email address, passport number, Starwood’s rewards information (including points and balance), arrival and departure information, reservation date, and their communication preferences.

Starwood said an unknown number of records contained encrypted credit card data, but has “not been able to rule out” that the components needed to decrypt the data wasn’t also taken.

“Marriott reported this incident to law enforcement and continues to support their investigation,” said the statement.

Marriott-owned Starwood the largest hotel chain in the world, with more than 11 brands covering 1,200 properties, including W Hotels, St. Regis, Sheraton, Westin, Element and more. Starwood branded timeshare properties are also included. The company said that its Marriott hotels are not believed to be affected as its reservation system is “on a different network.”

The company has begun informing customers of the breach — including in the U.S., Canada, and the U.K.

Given that the breach falls under the European-wide GDPR rules, Starwood may face significant financial penalties of up to four percent of its global annual revenue if found to be in breach of the rules.</s>Marriott Says Up To 500 Million Customers' Data Stolen In Breach

In one of the largest cybersecurity breaches in history, Marriott International said Friday that information on up to about 500 million of its customers worldwide was exposed in a breach of its Starwood guest reservation database dating as far back as 2014.

The world's largest hotel chain said it learned of the breach on Sept. 8.

The company said the Marriott hotel network was not affected. "The investigation only identified unauthorized access to the separate Starwood network," it said. Marriott acquired Starwood Hotels & Resorts Worldwide in 2016.

For 327 million of the affected guests, the compromised data includes "some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ("SPG") account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences," the company said.

For some customers, the information "also includes payment card numbers and payment card expiration dates, but the payment card numbers were encrypted," Marriott added. But the company said it could not rule out the possibility that the hackers were able to decrypt those details.

Starwood brands include W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Four Points by Sheraton and Starwood-branded timeshare properties.

Marriott said it reported the data breach to law enforcement officials and has begun to notify "regulatory authorities."

The attorneys general of New York, Pennsylvania and Massachusetts said they've opened investigations into the breach.

"New Yorkers deserve to know that their personal information will be protected," New York Attorney General Barbara Underwood said in a tweet.

"We want to know who was affected, what personal info was compromised, how it happened, and when Marriott knew about the #breach," Pennsylvania Attorney General Josh Shapiro tweeted.

Arne Sorenson, Marriott's president and chief executive officer, said: "We deeply regret this incident happened. We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward."

Marriott has set up a special website and call center to provide information on the incident. The U.S. call center number is (877) 273-9481. Marriott said it will begin notifying affected guests by email starting Friday.

The data breach is one of the largest in history. It's not as massive as the 2013 hack of Yahoo, which hit 3 billion users, and exposed data including names, email addresses, phone numbers, birthdates and passwords. But the Marriott breach includes sensitive data such as passport numbers, mailing addresses and credit card information.

Equifax said about 148 million people were impacted by a massive cybersecurity breach of the credit-reporting agency last year. That data included names, Social Security numbers, birthdates, addresses and, in some cases, driver's license numbers and credit card information.

The Marriott hack is "one of the most significant data breaches in history given the size ... and the sensitivity of the personal information that was stolen," Ted Rossman, an analyst with CreditCards.com, said in an email.

Given the sensitive personal information involved, he said, people "should be concerned that criminals could use this info to open fraudulent accounts in their names."

Rossman recommends that affected people freeze their credit by contacting credit agencies Experian, Equifax and TransUnion.</s>Nov 30 (Reuters) - Marriott International said on Friday the Starwood guest reservation database was breached, potentially exposing information on about 500 million guests.

The company said its investigation showed that an unauthorized party had copied and encrypted information, and that it had taken steps towards removing it. (Reporting by Munsif Vengattil in Bengaluru; Editing by Anil D’Silva)</s>BETHESDA, Md. (AP) — The Latest on a security breach inside Marriott's worldwide hotel empire that has compromised the information of as many as 500 million guests (all times local):

Security experts say a data breach that affected up to 500 million guests at Marriott hotels is one of the largest in the past decade in terms of size and scope. The fact that it took four years to discover is problematic, too.

They say the richness of the data taken makes the hack unique, especially if the hackers end up being hostile nation-states.

Chris Wysopal, chief technology officer of Veracode, says that with information about someone's arrival and departure dates, "that could be used to incriminate someone" or attack someone's reputation. He says it goes beyond the traditional credit-card theft or risk of identity theft.

Marriott says that unauthorized access to data at former Starwood hotels, which Marriott acquired two years ago, has been taking place since 2014.

Sen. Mark Warner of Virginia is appealing to Congress to pass laws that require data minimization following Marriott's disclosure of a data breach.

Warner, who is vice chairman of the Senate Select Committee on Intelligence and co-founder of the Senate Cybersecurity Caucus, said Friday that Congress should ensure that companies don't keep sensitive customer data that they no longer need.

Warner also said that new laws should make companies accountable for security costs.

The New York Attorney General is opening an investigation into a Marriott data breach that may have affected 500 million guests.

In a tweet Friday, Attorney General Barbara Underwood said residents need to know that their personal information is safe.

Marriott says that unauthorized access to data at former Starwood hotels, which Marriott acquired two years ago, has been taking place since 2014.

The affected hotel brands include W Hotels, St. Regis, Sheraton, Westin, Element, Aloft, The Luxury Collection, Le Méridien and Four Points. Starwood branded timeshare properties are also included.

None of the Marriott-branded chains are threatened.</s>Marriott discovered a data breach that could have affected up to 500 million guests, the company said Friday.

The hotel group revealed that hackers compromised the guest reservation database of its Starwood division.

An internal investigation found that its network was first breached in 2014, and that "an unauthorized party had copied and encrypted information." For around 327 million of those impacted, that data included names, addresses, phone numbers, emails, passport numbers and travel details.

Marriott noted that some of the stolen information also included payment card numbers and expiration dates. Even though this data is normally encrypted, the company said the encryption key data might've been stolen too.

"We fell short of what our guests deserve and what we expect of ourselves," said Arne Sorenson, Marriott's president and CEO, in a release.

"We are doing everything we can to support our guests, and using lessons learned to be better moving forward."

Firefox warning: It'll let you know if the website you're visiting suffered a data breach.

Facebook breach: A vulnerability put the data of 50 million users at risk</s>BETHESDA, Md. (AP) — The information of as many as 500 million people staying at Starwood hotels has been compromised and Marriott says it’s uncovered unauthorized access that’s been taking place within its Starwood network since 2014.

The company said Friday that credit card numbers and expirations dates of some guests may have been taken.

Marriott said that there was a breach of its database in September, which had guest information related to reservations at Starwood properties on or before Sept. 10.

Marriott discovered through the investigation that someone copied and encrypted guest information, and says it’s now working toward removing the information.

Marriott has set up a website and call center for anyone who thinks that they are at risk, and on Friday will begin sending emails to those affected.
Marriott International discloses that its Starwood Hotel brand had been subject to a data breach.