Updated October 2026: This post has been expanded from its original December 2018 version with the full story of the Starwood breach, the confusing notification emails, the fines and settlements that followed, and practical advice on spotting fake breach notices. It is a historical account; details describe the time it covers, not today.
On November 30, 2018, Marriott International announced that hackers had been inside the reservation database of its Starwood hotel brands for years. At first the company said records on up to roughly 500 million guests might be involved, which put it among the largest data breaches ever disclosed. Within days, millions of guests began receiving emails warning them that their information may have been exposed.
Many of those warnings looked suspicious. They did not come from marriott.com but from a separate domain, email-marriott.com, which security researchers quickly flagged as something a scammer could easily imitate. This post explains what the breach involved, why the notification emails worried experts, and what regulators did about it over the following six years. It also covers a lesson that still applies: how to tell a real breach notice from a phishing attempt.
What was stolen from Starwood
Starwood, the company behind hotel brands such as Sheraton, Westin, W Hotels and St. Regis, was acquired by Marriott in 2016. Investigators later established that attackers had first gained access to Starwood's guest reservation system in 2014, two years before the acquisition. The intrusion went unnoticed until September 2018, when Marriott detected suspicious activity. On November 19, 2018, the company determined that guest data had been accessed without authorization, and it went public eleven days later.
In January 2019, Marriott revised its estimate. The upper limit fell to about 383 million guest records, and because many guests appeared in the database more than once, the number of unique people affected was lower still, although Marriott said it could not pin down an exact figure. The stolen data covered guests who had booked at a Starwood property on or before September 10, 2018.
| Type of data | Approximate amount | Protection |
|---|---|---|
| Guest reservation records | Up to 383 million | Varied; names, addresses, contact details, and more |
| Passport numbers | 5.25 million | Unencrypted |
| Passport numbers | 20.3 million | Encrypted (Marriott later said some were hashed with SHA-1) |
| Payment card numbers | 8.6 million | Encrypted (later said to be hashed with SHA-1); about 354,000 unexpired |
Source: Marriott, "Marriott Provides Update on Starwood Database Security Incident," January 4, 2019, including its April 2024 correction.
The passport numbers drew particular concern. A credit card can be canceled in minutes, but a passport number is tied to a person for years and is valuable to anyone building a detailed profile of a traveler. In April 2024, Marriott added a correction to its original disclosure: the payment card numbers and some passport numbers had been protected with the older SHA-1 hashing method, not the AES-128 encryption the company had first described.
Who was behind it
In December 2018, The New York Times and The Washington Post reported that U.S. investigators suspected hackers working on behalf of the Chinese government, with the Post pointing to China's Ministry of State Security. Those reports relied on unnamed people briefed on preliminary findings, and China's government denied any knowledge of the breach. The attribution was never laid out in a public court case, so it is best described as a widely reported suspicion rather than an established fact.
The notification email that looked like phishing
To reach millions of affected guests, Marriott sent warning emails from email-marriott.com. On paper, that was a legitimate company-controlled domain. In practice, it gave recipients almost no way to confirm it was real.
TechCrunch reported that the domain itself did not load a website and did not present an HTTPS certificate identifying Marriott, so anyone who tried to check it found nothing reassuring. The only confirmation was a note on Marriott's breach information site. Meanwhile, the format of the domain, a brand name with an extra word bolted on, is exactly the pattern phishing gangs use when they register lookalike addresses.
The email anti-abuse organization Spamhaus made a similar point from the filtering side. The domain had been registered in 2014, about two decades after marriott.com, and a comparatively new domain suddenly sending huge volumes of unusual email is a classic warning sign for spam filters. Spamhaus suggested that companies in Marriott's position send notices from a subdomain of their main address, such as a "notification" subdomain under marriott.com, so the message inherits the trust and reputation of the brand's real domain.
Security researchers stepped in
Because the real domain was so easy to imitate, several researchers registered close misspellings before criminals could. According to Nextgov, Jake Williams of Rendition Infosec registered email-marriot.com, one letter short of the real domain, and FireEye researcher Nick Carr registered email-mariott.com. Both used the domains to display warnings rather than to collect anything. Troy Hunt, who runs the breach notification service Have I Been Pwned, also publicly flagged the problem. It was an unusual sight: outside experts paying to plug a hole in a major company's breach response.
What happened next
The Starwood breach became one of the first big tests of Europe's General Data Protection Regulation (GDPR), which took effect in May 2018, and it eventually drew action in the United States as well.
- 2014
Attackers gain access to Starwood's guest reservation system - 2016
Marriott completes its acquisition of Starwood - September 2018
Marriott detects suspicious activity in the Starwood database - November 30, 2018
Marriott announces the breach; notification emails follow - January 4, 2019
Estimate revised to up to 383 million guest records - July 2019
UK regulator proposes a fine of about £99 million - October 30, 2020
Final UK fine set at £18.4 million - October 9, 2024
FTC order and $52 million settlement with U.S. states
The UK fine
In July 2019, the UK Information Commissioner's Office (ICO) announced its intention to fine Marriott about £99.2 million. After Marriott made its case, and after the regulator considered the economic effects of the COVID-19 pandemic, the final penalty announced on October 30, 2020 was £18.4 million. The ICO counted about 339 million guest records worldwide, including around 7 million relating to people in the UK. Because GDPR only applies from May 2018, the fine covered just the final months of the intrusion.
The ICO's findings were blunt about what went wrong. It cited weak monitoring of privileged accounts, insufficient monitoring of the databases themselves, a lack of server hardening measures, and the failure to encrypt some personal data, including certain passport numbers.
U.S. settlements
In October 2024, the Federal Trade Commission and a coalition of state attorneys general announced settlements with Marriott covering three incidents: an earlier Starwood breach that began in 2014 and was disclosed in 2015, the larger Starwood breach described here, and a separate intrusion into Marriott's own network that began in September 2018 and went undetected until February 2020. Together, the incidents affected more than 344 million guest records.
Marriott agreed to pay $52 million to the states. The FTC could not impose a fine in this case, but its order requires Marriott to keep a comprehensive information security program, have it assessed by an independent party every two years, and certify compliance to the agency annually for 20 years. It also requires a data minimization policy and lets U.S. customers ask Marriott to delete personal information tied to their email address or loyalty number.
Why the email mattered as much as the breach
Breaches create a second wave of risk. As soon as a large company announces one, criminals start sending fake "your data was exposed" messages, hoping that worried customers will click a link and type in passwords or card numbers. A legitimate notice that looks like phishing makes that problem worse in two ways: it trains people to trust odd-looking senders, and it makes the real message harder to distinguish from the fake ones that follow.
The Marriott case pushed many security teams to plan breach communications in advance: which domain to send from, making sure it has a working website and valid certificate, and telling customers exactly what the real message will and won't ask them to do.
How to check a breach notice today
These habits protect you whether a warning is real or fake:
- Don't click links in the email. Open a browser and type the company's main web address yourself, then look for a breach or security notice on its official site.
- Look at the sender's domain, not the display name. A legitimate notice usually comes from the company's main domain or a subdomain of it. Treat a brand name with extra words attached as unconfirmed until the company's own site vouches for it.
- Never send passwords, card numbers or passport details in reply. Genuine breach notices tell you what happened and what the company is offering; they do not ask you to confirm sensitive data.
- Change reused passwords. If the affected account shares a password with any other account, change it everywhere and turn on two-factor authentication.
- Consider a credit freeze. In the U.S., freezing your credit with Equifax, Experian and TransUnion is free and blocks most new-account fraud. Thaw it temporarily when you need to apply for credit.
- Check whether your email appears in known breaches. Have I Been Pwned is a free service that lists breaches tied to an email address.
- Watch your loyalty accounts. Hotel and airline points are a common target. Review balances occasionally and report anything you didn't redeem.
If your passport number was exposed in a breach, the risk is lower than with a card number, but it is still worth keeping an eye on identity documents and travel bookings made in your name. Contact your passport authority if you see signs of misuse.
The bottom line
The Starwood breach is remembered for its size and for the years the attackers spent undetected. The email-marriott.com episode is a smaller footnote, but it captured a lesson that is easy to overlook: how a company tells people about a breach can either protect them or expose them to the next scam. For customers, the safest response to any breach notice is the same one that worked in 2018. Go to the company's website directly, and never hand over sensitive data through a link in an email.
Sources
- Marriott: Update on Starwood Database Security Incident (January 2019, with April 2024 correction)
- TechCrunch: Marriott's breach response and phishing risk
- Nextgov: Infosec experts buy Marriott-related sites to prevent spoofing
- Spamhaus: A domain-specific lesson from the Marriott incident
- NPR: Chinese hackers are responsible for Marriott data breach, reports say
- Hunton Andrews Kurth: ICO fines Marriott £18.4 million
- Hunton Andrews Kurth: FTC and state attorneys general settlements with Marriott
Top image: "Corridor Stanley Hotel Estes Park Colorado 2024" by Larry D. Moore, CC BY 4.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments