Maximise your Avios, air miles and hotel points

Marriott reveals that 500 million Starwood Preferred Guest hotel accounts were hacked

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

Marriott revealed this morning that it has identified a major breach of security at Starwood Preferred Guest, which Marriott inherited with its 2016 acquisition of Starwood Hotels & Resorts.

Astonishingly, the breach has been in place since 2014.  This means 500 million guest records are involved.

This is not a notional breach.  A Marriott investigation has shown that “an unauthorized party had copied and encrypted information”.

For over 300 million of the impacted guests, the data stolen involves:

  • name
  • mailing address
  • telephone number
  • email address
  • passport number
  • SPG account number
  • date of birth
  • arrival and departure stay information

Some guest have also had payment card numbers and expiration dates stolen, although this data was encrypted.  The bad news is that Marriott is refusing to rule out that the hacker had also stolen details of the two steps required to decrypt this information.

For the other 100 million+ guests, only their name and mailing or email address was stolen.

Marriott will begin sending emails today to affected guests whose email addresses are in the Starwood guest reservation database.

You can see the full Marriott statement on their website here.

On a more thoughtful note …… perhaps it is time to reconsider the whole ‘making your travel experience easier’ routine?  Whilst there are cost savings to be made as part of this, the airlines and hotels have been keen to collect unnecessary personal information now for many years primarily to smooth your journey.

No longer does a hotel check-in clerk need to manually copy out all your passport information, take your home address details and ask for a credit card deposit (at least for elite members).  It is all centrally stored in the system for when you arrive.  Except, when that system is not secure, your personal details are at risk. 

Given that it now virtually impossible to secure large corporate networks, companies should – at the very least – remove passport and credit card information from the data we are asked to store with them.


How to earn Marriott Bonvoy points and status from UK credit cards

How to earn Marriott Bonvoy points and status from UK credit cards (April 2024)

There are various ways of earning Marriott Bonvoy points from UK credit cards.  Many cards also have generous sign-up bonuses.

The official Marriott Bonvoy American Express card comes with 20,000 points for signing up, 2 points for every £1 you spend and 15 elite night credits per year.

You can apply here.

Marriott Bonvoy American Express

20,000 points sign-up bonus and 15 elite night credits each year Read our full review

You can also earn Marriott Bonvoy points by converting American Express Membership Rewards points at the rate of 2:3.

Do you know that holders of The Platinum Card from American Express receive FREE Marriott Bonvoy Gold status for as long as they hold the card?  It also comes with Hilton Honors Gold, Radisson Rewards Premium and MeliaRewards Gold status.  We reviewed American Express Platinum in detail here and you can apply here.

The Platinum Card from American Express

40,000 bonus points and a huge range of valuable benefits – for a fee Read our full review

You can also earn Marriott Bonvoy points indirectly:

and for small business owners:

The conversion rate from American Express to Marriott Bonvoy points is 2:3.

Click here to read our detailed summary of all UK credit cards which can be used to earn Marriott Bonvoy points

(Want to earn more hotel points?  Click here to see our complete list of promotions from the major hotel chains or use the ‘Hotel Offers’ link in the menu bar at the top of the page.)

Comments (57)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Scallder says:

    Share price is down 4.5% pre-market opening

  • Jay says:

    Hacked & breached are the wrong words, they should refer to it as ‘data sharing’. I only had an SPG account for a couple years, wonder if i signed up with the hackers directly they will have given me a higher signup bonus.

  • Mark says:

    Needless to say I don’t feel very “preferred” at the moment.

  • Andrew says:

    “perhaps it is time to reconsider the whole ‘making your travel experience easier’ routine”

    I trust you’ll stop pushing awardwallet so much then?

    • Ben says:

      Award Wallet has an option to store data locally on your computer or device. Not quite as convenient but a good, secure design decision.

  • Neil says:

    Quote: “Given that it [sic] now virtually impossible to secure large corporate networks”

    What a ridiculous thing to say. Of course it’s possible, they just didn’t do it right.

    That’s like saying most planes are virtually not airworthy, when it was the negligence of a few ground engineers that caused the LionAir plane/sensors to fail. The majority of planes are fine to fly and we trust the airlines to employ sufficiently capable engineers to maintain them correctly.

    • Nick says:

      Agree! You only have to speak with previous employees of the likes of BA IT department, many of whom were made redundant a few years ago, due to outsourcing, to understand where these issues largely come from.

    • Alex W says:

      Negligence is a strong term to use while the investigation is still ongoing.

  • Sundar says:

    More information below as tweeted by Amex
    https://answers.kroll.co.uk

  • Nick says:

    It just goes to show that, yet again, as I’ve said before, some of the largest corporations on this planet, employing some of the largest number of, so called, IT specialists, are still some of the most incompetent companies on the planet with reagards to data security! 🙂

    The term “Pathetic” is being nice to them!

    • Doug M says:

      Because decision makers don’t always listen to do it right, when all they want to hear is do it cheap.

      • Nick says:

        I agree, and you only need to look at BA IT, as I posted earlier, to, probably, back that assertion up! 🙂

    • Dwb1873 says:

      Large companies tend to be driven more strongly by detached metrics. They will use the lowest priced suppliers, the lowest paid staff they can, to standards that are deemed good enough , often by people too detached to know what they are actually signing off. To be fair, small companies often just don’t bother at all and live in happy obliviousness.

      I think it’s rather unfair to lay this at the door of the IT staff. They MIGHT be incompetent but equally they might have had their hands completely tied. At least someone out in a system that finally noticed it.

      Every one of these data losses improves the chance that the issue gets greater Board attention.

      On the other hand, The downside is people are fickle and it’s a very real statement that long term damage is questionable outside of the initial hyperbole. People still use talk talk, still fly BA, still use Facebook etc.

  • Alex W says:

    One time a hotel in India took photocopies of our passports at check in. The next day, as there was no info in the room, we asked at reception what times the restaurant was open. They were kindly written down for us on a piece of paper. On the other side was a photocopy of my wife’s passport. When we complained she just crossed out the passport details and handed us the piece of paper. Just one of many issues we listed in an absolute stinker of a review on TripAdvisor!

    • Shoestring says:

      I distinctly remember quite a few hotels taking my passport off me at check in and leaving it on view in the pigeon hole for my room number behind the reception desk, alongside the passports of all the other guests! You got it back when you checked out.

      Can only have been 20-25 years ago.

      Innocent days (or stupid?)

    • Choons says:

      I stayed in a SPG hotel once where their scrap/spare paper had what customers had paid for their rooms on the other side – this was only in 2012. At least I was reassured that I had not over paid compared to other people – and I booked through BA then too.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.