Marriott Hotels says its guest reservation system has been hacked, potentially exposing the personal information of approximately 500 million guests.
The hotel chain said Friday the hack affects its Starwood reservation database, a group of hotels it bought in 2016 that includes the St. Regis, Westin, Sheraton and W Hotels.
Marriott said hackers had gained “unauthorized access” to the Starwood reservation system since 2014, but the company only identified the issue last week.
“The company recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it,” Marriott said in a statement.
For 327 million people, Marriott says the guests’ exposed information includes their names, phone numbers, email addresses, passport numbers, date of birth and arrival and departure information. For millions others, their credit card numbers and card expiration dates were potentially compromised.
Marriott warns that it can’t confirm if the hackers were able to decrypt the credit card numbers.
“We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward,” said CEO Arne Sorenson in a statement.
The hotel chain said it has reported the hack to law enforcement. Marriott said it will begin emailing guests affected by the breach and has created an informational website.
Marriott’s (MAR) stock is plunging on the news, falling nearly 6% in premarket trading. The combined company has 5,700 properties in more than 110 countries.
