Marriott says data breach affects up to 5.2 million customers

Company discovered it at the end of February

Up to 345 employees at Marriott hotels in Gaithersburg and North Bethesda could be laid off, according to worker dislocation notices filed last week with the Maryland Department of Labor

Marriott International, which is based in Bethesda, said Tuesday that a data breach it discovered at the end of February could affect up to 5.2 million of its customers.

The company has traced the breach to someone using log-in credentials of two employees at one of its franchise properties, starting in mid-January.

The company said in a statement it posted Tuesday that the following types of information from customers might have been accessed:

contact details (such as name, mailing address, email address, and phone number)
loyalty account information (such as account number and points balance, but not passwords)
additional personal details (such as company, gender, and birthday day and month)
partnerships and affiliations (such as linked airline loyalty programs and numbers)
preferences (such as stay/room preferences and language preference)

“Upon discovery, the company confirmed that the login credentials were disabled, immediately began an investigation, implemented heightened monitoring, and arranged resources to inform and assist guests,” the statement says. “Marriott also notified relevant authorities and is supporting their investigations.”

- Advertisement -

Marriott said it does not think the breach involves Marriott Bonvoy account passwords or PINs, payment card information, passport information, national IDs, or driver’s license numbers.

The company said that on Tuesday, it emailed guests who were affected. It has set up a website (www.mysupport.marriott.com) and call center (800-598-9655 in the U.S.) with additional information for guests.

Marriott said the email it sent and the website outline steps that guests can take. Guests may enroll in an information monitoring service called IdentityWorks for free for one year.

Marriott’s statement says the company “carries insurance, including cyber insurance, commensurate with its size and the nature of its operations, and the company is working with its insurers to assess coverage. The company does not currently believe that its total costs related to this incident will be significant.”