Maximise your Avios, air miles and hotel points

Marriott reveals that 500 million Starwood Preferred Guest hotel accounts were hacked

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

Marriott revealed this morning that it has identified a major breach of security at Starwood Preferred Guest, which Marriott inherited with its 2016 acquisition of Starwood Hotels & Resorts.

Astonishingly, the breach has been in place since 2014.  This means 500 million guest records are involved.

This is not a notional breach.  A Marriott investigation has shown that “an unauthorized party had copied and encrypted information”.

For over 300 million of the impacted guests, the data stolen involves:

  • name
  • mailing address
  • telephone number
  • email address
  • passport number
  • SPG account number
  • date of birth
  • arrival and departure stay information

Some guest have also had payment card numbers and expiration dates stolen, although this data was encrypted.  The bad news is that Marriott is refusing to rule out that the hacker had also stolen details of the two steps required to decrypt this information.

For the other 100 million+ guests, only their name and mailing or email address was stolen.

Marriott will begin sending emails today to affected guests whose email addresses are in the Starwood guest reservation database.

You can see the full Marriott statement on their website here.

On a more thoughtful note …… perhaps it is time to reconsider the whole ‘making your travel experience easier’ routine?  Whilst there are cost savings to be made as part of this, the airlines and hotels have been keen to collect unnecessary personal information now for many years primarily to smooth your journey.

No longer does a hotel check-in clerk need to manually copy out all your passport information, take your home address details and ask for a credit card deposit (at least for elite members).  It is all centrally stored in the system for when you arrive.  Except, when that system is not secure, your personal details are at risk. 

Given that it now virtually impossible to secure large corporate networks, companies should – at the very least – remove passport and credit card information from the data we are asked to store with them.


How to earn Marriott Bonvoy points and status from UK credit cards

How to earn Marriott Bonvoy points and status from UK credit cards (April 2024)

There are various ways of earning Marriott Bonvoy points from UK credit cards.  Many cards also have generous sign-up bonuses.

The official Marriott Bonvoy American Express card comes with 20,000 points for signing up, 2 points for every £1 you spend and 15 elite night credits per year.

You can apply here.

Marriott Bonvoy American Express

20,000 points sign-up bonus and 15 elite night credits each year Read our full review

You can also earn Marriott Bonvoy points by converting American Express Membership Rewards points at the rate of 2:3.

Do you know that holders of The Platinum Card from American Express receive FREE Marriott Bonvoy Gold status for as long as they hold the card?  It also comes with Hilton Honors Gold, Radisson Rewards Premium and MeliaRewards Gold status.  We reviewed American Express Platinum in detail here and you can apply here.

The Platinum Card from American Express

40,000 bonus points and a huge range of valuable benefits – for a fee Read our full review

You can also earn Marriott Bonvoy points indirectly:

and for small business owners:

The conversion rate from American Express to Marriott Bonvoy points is 2:3.

Click here to read our detailed summary of all UK credit cards which can be used to earn Marriott Bonvoy points

(Want to earn more hotel points?  Click here to see our complete list of promotions from the major hotel chains or use the ‘Hotel Offers’ link in the menu bar at the top of the page.)

Comments (57)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Choons says:

    Not another one!
    For me that makes BA, Marriott (SPG), Sodexo, Uber and Yahoo! No compensation for the hassle involved in changing id, not that I can change address or passport number easily either! and that’s across multiple family accounts.

  • Scallder says:

    So 300 million people have had their home address stolen, and specific details about when they’re not going to be at home. Great…

    • Mark says:

      That’s what I first thought!

      • Graeme says:

        Always my first thought too. You can replace cards and recover money taken from accounts, but I really don’t want people to know when I won’t be at home.

    • Thomas Howard says:

      Most people burgling houses will usually establish whether someones in by knocking on the door. If you answer they’ll pretend to be selling mops or handing out religious leaflets. Trying to buy out of date databases on the dark web would be a lot of bother.

      This will probably be used for other online crime, taking out loans, opening bank accounts, etc.

  • Doug M says:

    So putting my passport through the washing machine meaning a new one when I returned home a couple of weeks ago is now looking pretty smart 🙂

  • ed says:

    hack has been going on from 2014 to sept 2018, so suspect most travel has already been completed. I’d also suspect that whether it is this hack or another, the personal information of most / all of us accessing this site is on the web somewhere.

  • Jon says:

    I suppose one advantage of our little credit card churning hobby is that it at least limits how far back our card fraud risk could go…

    • Chris says:

      No not really, anyone can change a credit card never – you got plan to change your name, dob and address?

      • Jon says:

        My point was just that if you regularly churn your SPG Amex (or any other cards you may have used with SPG) then anyone stealing the card data isn’t going to have much luck making fraudulent purchases with them.

  • Ben says:

    This is just Starwood bookings and system right? Anything booked directly on Marriott or into a Marriott branded property isnt affected?

    • Michael Jennings says:

      Hopefully it also means that no data has been stolen since the merger of the Starwood/Marriott systems in August, too.

      • Nick says:

        Well, let’s just hope that Starwood didn’t hide this issue during due diligence! 🙂

      • John says:

        “Marriott is also devoting the resources necessary to phase out Starwood systems and accelerate the ongoing security enhancements to our network”

        sounds like the spg systems are still running reservations (and i’d suspect those systems are on least-cost maintenance), and that the breach only was detected due to overall improvements in security and monitoring

  • Alan says:

    Wow that’s a massive breach, over such a long period too. I take it they only just discovered it? Otherwise they’ll hopefully be in line for some hefty GDPR fines…

    • Lady London says:

      In that case I am sure they will have “only just discovered it”. Oh, wait… they’ve said that haven’t they?

      • Alan says:

        Actually their website statement (which I’ve now had a chance to look at) says they discovered it on the 19th Nov, so they’ve already failed to notify within 72h as per GDPR!

  • Russ says:

    Oh let’s just get it all out the way and move on:

    My name is Russell Lingus, D.O.B: 01/11/1986, Passport number: 46559871, British Citizen, lives at 27 Privet Drive, Chorley, RS1 OEP, out shopping Friday nights between 18.30 to 19.30. Rolex’s and wife’s jewelry in the safe behind the picture of mother-in-law pass code DO, A Dere, A FeMail Deer, (case sensitive). Email wheneveryouareready.co.uk.com. Please close door behind you.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.