marriott sign

Marriott Discloses Second Security Breach, Affecting Millions, In Two Years

The hack took place through Marriott Bonvoy, the company's loyalty app, and affected up to 5.2 million guests.

Disclosing its second major security breach in the past two years, the international hotel chain Marriott announced on Tuesday that a hacker had accessed data affecting up to 5.2 million guests who used Marriott Bonvoy, the company’s loyalty app.

Marriott said the hack first began in mid-February but company officials did not become aware until the end of February. A breach notification published on Marriott’s website details how a hacker used login credentials of two employees at a Marriott property to access customer information from the Bonvoy database.

“Upon discovery, we confirmed that the login credentials were disabled, immediately began an investigation, implemented heightened monitoring, and arranged resources to inform and assist guests,” the breach notification reads.

While the company investigation remains ongoing, Marriott has not found evidence that the hacker accessed account passwords, payment card information, passport information, national ID numbers or driver’s license numbers. The exposed information did include the following:

  • Contact details (e.g., name, mailing address, email address, and phone number)
  • Loyalty account information (e.g., account number and points balance, but not passwords)
  • Additional personal details (e.g., company, gender, and birthday day and month)
  • Partnerships and affiliations (e.g., linked airline loyalty programs and numbers)
  • Preferences (e.g., stay/room preferences and language preference)

Not all of this information was entered for each guest, the company said. Guests involved in the breach were notified by Marriott on Tuesday, and the chain has also set up a self-service online portal for guests to identify if their information was involved in the breach. Affected individuals can also see what categories of information were part of the breach.

Paul Bischoff, a privacy advocate with the tech research and consumer website Comparitech, said that the biggest threat facing Marriott customers in the recent breach is “targeted phishing.”

“Guests should be on the lookout for targeted messages from scammers posing as Marriott or a related company,” Bischoff said. “Don't click on links or attachments in unsolicited emails. Check email addresses and don't just trust display names. If you're uncertain as to whether a message is legitimate or not, ask Marriott using contact information found through Google.”

Back in November 2018, Marriott also disclosed that hackers had accessed personal details of an estimated 500 million guests worldwide through the Starwood Hotels reservation system it had acquired. While the company has since lowered the total to 383 million, Marriott has faced penalties in the U.K. for lax cybersecurity practices. Chinese hackers are suspected in that case.

Andrew Hollister, the director of LogRhythm Labs, noted that there are some positives to draw from Marriott’s disclosure on Tuesday, particularly in the company’s response time to the breach.

“In the previous incident in 2018, Marriott detected signs of unauthorized activity going back four years,” Hollister said. “In this new case, the activity appears to have begun in January 2020 and been detected during the course of February 2020. This is a significant improvement in time to detect and respond to a data breach.”

He added: “This latest data breach just goes to show that continuing vigilance is required to keep reducing the time to detect and respond to threats, and that real reductions in impact can be made with focus on this issue which affects every company on the globe which holds personal information.”

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Paving the Way to Smart Buildings

    In today's rapidly evolving security landscape, the convergence of on-prem, edge and cloud technologies are critical. The physical security landscape is undergoing a profound transformation, driven by the rapid digitalization of buildings and the evolving needs of modern organizations. As the buildings sector pivots towards smart, AI and data-driven operations, the integration of both edge and cloud technology has become crucial. Read Now

  • The Cybersecurity Time Bomb

    If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk. Read Now

  • Deploying in a Hybrid, Cloud Environment

    The way organizations manage access control is evolving. Traditional on-premises systems come with high IT and server requirements. At the same time, fully cloud-based solutions may not meet the needs of every facility. Read Now

  • Facing Facts for Facilities

    Despite the proliferation of constantly evolving security solutions, there remains a troubling trend among many facility operators who often neglect the most important security assets within their organization. Keys and shared devices like radios, laptops and tablets are crucial to successful operations, yet many operators are managing them haphazardly through outdated storage systems like pegboards and notebooks. Read Now

  • Report Reveals Security Training Reduces Global Phishing Click Rates by 86%

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, today launched its “Phishing by Industry Benchmarking Report 2025” which measures an organization’s Phish-prone Percentage (PPP) — the percentage of employees likely to fall for social engineering or phishing attacks, indicating the organization’s overall susceptibility to phishing threats. This year’s report found a global average baseline PPP of 33.1%, meaning a third of employees interact with phishing simulations before taking part in best-practice security awareness training (SAT).COVER 2025-PIB-NA-Report_EN-US Read Now

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”