Subject: Starwood Guest Reservation Database Security Incident
From: "Starwood Hotels" <[email-masked]>
To: <[email-masked]>
Date: Sat, 08 Dec 2018 21:11:32 +0000

Notice of Data Security I=cident

=img src="http://images.harmony.epsilon.com/ContentHandler/images?i==693617ac-a5f2-412d-b11f-6ed17e086825" width="230" height="100" bord=r="0" alt="SPG | Starwood Preferred Guest" style="display:block;" cl=ss="center" />

California=Residents | California - =spañol

ا�=84عربية | 繁體中文 | 简体中文 | Deutsch

Españ=l (España) | Espa=C3�ol (Latinoamérica)

Franç=is (Canadien) | Fran�=A7ais | Italiano

日=E6��語 | Portu=uês (Europeu) | Port=guês (Brasil)

한=EA��어 | �=A0усский

Dear Valued Guest,

Marriott values our guests and understands the importance of protecting =our personal information. We have taken measures to investigate and addr=ss a data security incident involving the Starwood guest reservation datab=se. The investigation has determined that there was unauthorized access =o the database, which contained guest information relating to reservations=at Starwood properties* on or before September 10, 2018. This notice exp=ains what happened, measures we have taken, and some steps you can take in=response.

Starwood Guest Reservation Database Se=urity Incident

On September 8, 2018, Marriott received a= alert from an internal security tool regarding an attempt to access the S=arwood guest reservation database. Marriott quickly engaged leading secu=ity experts to help determine what occurred. Marriott learned during the=investigation that there had been unauthorized access to the Starwood netw=rk since 2014. Marriott recently discovered that an unauthorized party h=d copied and encrypted information, and took steps towards removing it. =n November 19, 2018, Marriott was able to decrypt the information and dete=mined that the contents were from the Starwood guest reservation database=2E

Marriott has not finished identifying duplicate information in the datab=se, but believes it contains information on up to approximately 500 millio= guests who made a reservation at a Starwood property. For approximately=327 million of these guests, the information includes some combination of =ame, mailing address, phone number, email address, passport number, Starwo=d Preferred Guest ("SPG") account information, date of birth, gender, arri=al and departure information, reservation date, and communication preferen=es. For some, the information also includes payment card numbers and pay=ent card expiration dates, but the payment card numbers were encrypted usi=g Advanced Encryption Standard encryption (AES-128). There are two compo=ents needed to decrypt the payment card numbers, and at this point, Marrio=t has not been able to rule out the possibility that both were taken. Fo= the remaining guests, the information was limited to name and sometimes o=her data such as mailing address, email address, or other information.

Marriott reported this incident to law enforcement and continues to supp=rt their investigation. The company is also notifying regulatory authori=ies.

Marriott deeply regrets this incident happened. From the start, we mov=d quickly to contain the incident and conduct a thorough investigation wit= the assistance of leading security experts. Marriott is working hard to=ensure our guests have answers to questions about their personal informati=n with a dedicated website and call center. We are supporting the effort= of law enforcement and working with leading security experts to improve=2E Marriott is also devoting the resources necessary to phase out Starwood=systems and accelerate the ongoing security enhancements to our network.=div style="font-size:35px; mso-line-height-rule:exactly; line-height:35p=;">

Guest Support

Marrio=t has taken the following steps to help you monitor and protect your infor=ation:

Dedicated Call Center

Marriott has established a dedicated call center to answer questions you =ay have about this incident. The call center is open seven days a week, =nd is available in multiple languages. Our dedicated call center may exp=rience high volume initially, and we appreciate your patience.
=

Email notification

M=rriott began sending emails on a rolling basis on November 30, 2018 to aff=cted guests whose email addresses are in the Starwood guest reservation da=abase.

Free WebWatcher Enrollment
Marriott is providing guests the opportunity to enroll in WebWatcher=free of charge for one year. WebWatcher monitors internet sites where pe=sonal information is shared and generates an alert to the consumer if evid=nce of the consumer’s personal information is found. Due to regu=atory and other reasons, WebWatcher or similar products are not available =n all countries. Guests from the United States who complete the WebWatch=r enrollment process will also be provided fraud consultation services and=reimbursement coverage for free.

The section below provides additional information on steps you can take=2E If you have questions about this notification and to enroll in WebWatch=r (if it is available in your country), please visit info.starwoodhotels=2Ecom.

* Starwood brands include: W Hotels, St. Regis, Sheraton Hotels & Reso=ts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Coll=ction, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points b= Sheraton and Design Hotels. Starwood branded timeshare properties are a=so included.

Best wishes,

Arne Sorenson

MORE INFORMATION ON STEPS YOU CAN T=KE

Regardless of where you reside, below are some additional steps you can =ake.

•

Monitor your SPG acco=nt for any suspicious activity.

•

Change your password =egularly. Do not use easily guessed passwords. Do not use the same pas=words for multiple accounts.

•

Review your payment c=rd account statements for unauthorized activity and immediately report una=thorized activity to the bank that issued your card.

•

Be vigilant against t=ird parties attempting to gather information by deception (commonly known =s "phishing"), including through links to fake websites. Marriott will n=t ask you to provide your password by phone or email.

•

If you believe you ar= the victim of identity theft or your personal data has been misused, you =hould immediately contact your national data protection authority or local=law enforcement.

If you are a resident of the United St=tes:

We remind you it is always advisable to be vigilan= for incidents of fraud or identity theft by reviewing your account statem=nts and free credit reports for any unauthorized activity. You may obtai= a copy of your credit report, free of charge, once every 12 months from e=ch of the three nationwide credit reporting companies. To order your ann=al free credit report, please visit www.annualcreditreport.com or ca=l toll free at 1-877-322-8228. Contact information for the three nationw=de credit reporting companies is as follows:

Equifax, PO Bo= 740241, Atlanta, GA 30374, www.equifax.com, 1-800-685-1111

Experian, PO B=x 2002, Allen, TX 75013, www.experian.com, 1-888-397-3742

TransUnion, PO=Box 2000, Chester, PA 19016, www.transunion.com, 1-800-916-8800

If you believe you are the victim of identity theft or have reason to be=ieve your personal information has been misused, you should immediately co=tact the Federal Trade Commission and/or the Attorney General’s of=ice in your state. You can obtain information from these sources about s=eps an individual can take to avoid identity theft as well as information =bout fraud alerts and security freezes. You should also contact your loc=l law enforcement authorities and file a police report. Obtain a copy of=the police report in case you are asked to provide copies to creditors to =orrect your records. Contact information for the Federal Trade Commissio= is as follows:

Federal Trade Comm=ssion, Consumer Response Center, 600 Pennsylvania Avenue, NW Washingto=, DC 20580, 1-877-IDTHEFT (438-4338), www.ftc.gov/idtheft

If you are a resident of Connecticut, Maryland, Massachusetts, North =arolina, or Rhode Island, you may contact and obtain information from =our state attorney general at:

Connecticut Attorn=y General's Office, 55 Elm Street, Hartford, CT 06106, www.ct.gov/ag=/a>, 1-860-808-5318

Maryland Attorney =eneral's Office, 200 St. Paul Place, Baltimore, MD 21202, www.oag.=tate.md.us, 1-888-743-0023 or 1-410-576-6300

Office of the Mass=chusetts Attorney General, One Ashburton Place, Boston, MA 02108, www=2Emass.gov/ago/contact-us.html, 1-617-727-8400

North Carolina Att=rney General's Office, 9001 Mail Service Center, Raleigh, NC 27699, =a href="http://email-marriott.com/T/v4000001678fa935a78e518ff4bbc782e8=9bae732e33b544430000021ef3a0bcdc/9bae732e-33b5-4443-8f71-b23a1215ad48?__dU=_=v0G4RBKTXg2GvMkOJesaYIzG4U7guhmTRETuYnTC-1zsA=" target="_blank">ww=.ncdoj.gov, 1-919-716-6400 or 1-877-566-7226

Rhode Island Attor=ey General’s Office, 150 South Main Street, Providence, RI 029=3,

If you are a resident of Massachusetts or Rhode Island, note that=pursuant to Massachusetts or Rhode Island law, you have the right to file =nd obtain a copy of a police report. You also have the right to request = security freeze.

If you are a resident of West Virginia, you have the right to ask=that nationwide consumer reporting agencies place “fraud alerts�=80� in your file to let potential creditors and others know that you may=be a victim of identity theft, as described below. You also have a right=to place a security freeze on your credit report, as described below.

Fraud Alerts: There are two types of fraud alerts you can place o= your credit report to put your creditors on notice that you may be a vict=m of fraud—an initial alert and an extended alert. You may ask t=at an initial fraud alert be placed on your credit report if you suspect y=u have been, or are about to be, a victim of identity theft. An initial =raud alert stays on your credit report for at least 90 days. You may hav= an extended alert placed on your credit report if you have already been a=victim of identity theft with the appropriate documentary proof. An exte=ded fraud alert stays on your credit report for seven years. You can pla=e a fraud alert on your credit report by contacting any of the three natio=al credit reporting agencies.

Credit Freezes: You have the right to put a credit freeze, also k=own as a security freeze, on your credit file, free of charge, so that no =ew credit can be opened in your name without the use of a PIN number that =s issued to you when you initiate a freeze. A security freeze is designe= to prevent potential credit grantors from accessing your credit report wi=hout your consent. If you place a security freeze, potential creditors a=d other third parties will not be able to get access to your credit report=unless you temporarily lift the freeze. Therefore, using a security free=e may delay your ability to obtain credit.

There is no fee to=place or lift a security freeze. Unlike a fraud alert, you must separate=y place a security freeze on your credit file at each credit reporting com=any. For information and instructions to place a security freeze, contac= each of the credit reporting agencies at the addresses below:
=/div>

Experian Security =reeze, PO Box 9554, Allen, TX 75013, www.experian.com

TransUnion Securit= Freeze, PO Box 2000, Chester, PA 19016, www.transunion.com

Equifax Security F=eeze, PO Box 105788, Atlanta, GA 30348, www.equifax.com

To request a security freeze, you will need to provide the following inf=rmation:

1.

Your full name (inclu=ing middle initial as well as Jr., Sr., II, III, etc.)

2.

Social Security numbe=

3.

Date of birth

4.

If you have moved in =he past five years, provide the addresses where you have lived over the pr=or five years

5.

Proof of current addr=ss such as a current utility bill or telephone bill

6.

A legible photocopy o= a government issued identification card (state driver's license or ID car=, military identification, etc.)

7.

If you are a victim o= identity theft, include a copy of the police report, investigative report= or complaint to a law enforcement agency concerning identity theft

The credit reporting agencies have one business day after receiving your=request by toll-free telephone or secure electronic means, or three busine=s days after receiving your request by mail, to place a security freeze on=your credit report. The credit bureaus must also send written confirmati=n to you within five business days and provide you with a unique personal =dentification number ("PIN") or password or both that can be used by you t= authorize the removal or lifting of the security freeze.

To lift the security freeze in order to allow a specific e=tity or individual access to your credit report, or to lift a security fre=ze for a specified period of time, you must submit a request through a tol=-free telephone number, a secure electronic means maintained by a credit r=porting agency, or by sending a written request via regular, certified, or=overnight mail to the credit reporting agencies and include proper identif=cation (name, address, and Social Security number) and the PIN number or p=ssword provided to you when you placed the security freeze as well as the =dentity of those entities or individuals you would like to receive your cr=dit report or the specific period of time you want the credit report avail=ble. The credit reporting agencies have one business day after receiving=your request by toll-free telephone or secure electronic means, or three b=siness days after receiving your request by mail, to lift the security fre=ze for those identified entities or for the specified period of time.

To remove the security freeze, you must submit a request th=ough a toll-free telephone number, a secure electronic means maintained by=a credit reporting agency, or by sending a written request via regular, ce=tified, or overnight mail to each of the three credit bureaus and include =roper identification (name, address, and Social Security number) and the P=N number or password provided to you when you placed the security freeze=2E The credit bureaus have one business day after receiving your request b= toll-free telephone or secure electronic means, or three business days af=er receiving your request by mail, to remove the security freeze.
&nb=p;

Fair Credit Reporting Act: You also have rights under the federal=Fair Credit Reporting Act, which promotes the accuracy, fairness, and priv=cy of information in the files of consumer reporting agencies. The FTC h=s published a list of the primary rights created by the FCRA (https://www=2Econsumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf),=and that article refers individuals seeking more information to visit www=2Eftc.gov/credit. The FTC’s list of FCRA rights includes:
&=bsp;

•

You have the right to=receive a copy of your credit report. The copy of your report must conta=n all the information in your file at the time of your request.

•

Each of the nationwid= credit reporting companies – Equifax, Experian, and TransUnion &nda=h; is required to provide you with a free copy of your credit report, at y=ur request, once every 12 months.

•

You are also entitled=to a free report if a company takes adverse action against you, like denyi=g your application for credit, insurance, or employment, and you ask for y=ur report within 60 days of receiving notice of the action. The notice w=ll give you the name, address, and phone number of the credit reporting co=pany. You are also entitled to one free report a year if you’re =nemployed and plan to look for a job within 60 days; if you are on welfare= or if your report is inaccurate because of fraud, including identity thef=.

•

You have the right to=ask for a credit score.

•

You have the right to=dispute incomplete or inaccurate information.

•

Consumer reporting ag=ncies must correct or delete inaccurate, incomplete, or unverifiable infor=ation.

•

Consumer reporting ag=ncies may not report outdated negative information.

•

Access to your file i= limited. You must give your consent for reports to be provided to emplo=ers.

•

You may limit "prescr=ened" offers of credit and insurance you receive based on information in y=ur credit report.

•

You may seek damages =rom violators.

•

Identity theft victim= and active duty military personnel have additional rights.

If You Are A European Union Data Subject, you may contact or obta=n information from your Data Protection Authority at:

Austria: �=96sterreichische Datenschutzbehörde, Wickenburggasse 8, 1080 Vienna, =43 1 52 152 0, Email: [email-masked]

Belgium: De Ge=evensbeschermingsautoriteit (GBA), Rue de la Presse 35, 1000 Brussels, +32=(0)2 274 48 00, Email: [email-masked]

Bulgaria: Comm=ssion for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd=2E, Sofia 1592, +359 899 877 156, Email: [email-masked]

Croatia: Croat=an Personal Data Protection Agency (AZOP), Fra Grge Martića 14, HR-10=000 Zagreb, +385 (0)1 4609-000, Email: [email-masked]

Cyprus: Office=of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia =office address), P.O. Box 23378, 1682 Nicosia, Cyprus (postal address)= +357 22818456, Email: [email-masked]
&nbs=;

Czechia (Czech Rep=blic): The Office for Personal Data Protection, Pplk. Sochora 27, 17= 00 Praha 7, +420 234 665 111, Email: [email-masked]

Denmark: Datat=lsynet, Borgergade 28, 5, 1300 København, +45 33 19 32 00 (Monday �=80� Thursday 9:00am to 12:00pm and 12:30 to 3:30pm, Friday 9:30am to 12:=0pm), Email: dt@=atatilsynet.dk

Estonia: Andme=aitse Inspektsioon, 19 Väike-Ameerika St., 10129 Tallinn, +372 627 =135, Email: info@aki.=e

Finland: Tieto=uojavaltuutetun toimisto, Ratapihantie 9, 6th Floor, 00520, Helsinki (offi=e address), P.O. Box 800, 00521 Helsinki (postal address), +358 29 566=6700, Email (registry): [email-masked]

France: Commis=ion nationale de l’informatique et des libertés (CNIL), 3 Pla=e de Fontenoy TSA 80715, 75334 PARIS CEDEX 07, +33 01 53 73 22 22 (Monday =o Thursday 9:00am to 6:30pm, Friday 9:00am to 6:00pm)

Germany: Die B=ndesbeauftragte für den Datenschutz und die Informationsfreiheit (BfD=), Husarenstr. 30 - 53117 Bonn, +49 (0)228-997799-0, Email: [email-masked]=2Ede. (You may also contact the Data Protection Agency in your Bunde=land.)

Greece: Data P=otection Authority Offices, Kifissias 1-3, 115 23 Athens, +30-210 6475600,=Email: contact@dpa=2Egr

Hungary: Nemze=i Adatvédelmi és Információszabadság Hatós=C3�g, H-1125 Budapest, Szilágyi Erzsébet fasor 22/C, +36 1 391=1400, Email: privac=@naih.hu

Ireland: Data =rotection Commission (Comisiún Cosanta Sonraí), Canal House, Sta=ion Road, Portarlington, R32 AP23 Co. Laois, +353 57 868 4800, +353 (076=) 104 800, Email: [email-masked]

Italy: Garante=per la protezione dei dati personali, Piazza Venezia 11 – 00187 Ro=a, +39 06 6967 71, +39 06 6967 72917, Email: [email-masked]

Latvia: Data S=ate Inspectorate, Blaumana Street 11 / 13–11, Riga, LV–101=, +371 67 22 31 31 (1:00 to 3:00pm), Email: [email-masked]

Lithuania: Val=tybinė duomenų apsaugos inspekcija, A. Juozapavičiaus g=2E 6, 09310 Vilnius 6, 09310 Vilnius, +370 (8 5) 271 2804, 279 1445, Email= paštas [email-masked]=

Luxembourg: Co=mission Nationale Pour La Protection Des Données (CPND), 1, avenue du=Rock’n’Roll, L-4361 Esch-sur-Alzette, +352 26 10 60 �=93 1

Malta: Office =f the Information and Data Protection Commissioner (IDPC), Level 2, Airway= House, High Street, Sliema SLM 1549, +356 2328 7100, Email: [email-masked]=2Emt

Netherlands: A=toriteit Persoonsgegevens, Postbus 93374, 2509 AJ DEN HAAG, +31 (0)70 888 =5 00

Poland: Urz�=85d Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, +48 22 531 =3 00, Email: [email-masked]

Portugal: Comi=são Nacional de Protecção de Dados (CNPD), Av. D. Carlo= I, 134 - 1.º, 1200-651 Lisboa, +351 21 392 84 00, Email: [email-masked]
=/div>

Romania: Autor=tatea Naţională de Supraveghere a Prelucrării Datelor cu Ca=acter Personal (ANSPDCP), 28-30 G-ral Gheorghe Magheru Bld., District 1,=post code 010336, Bucharest, +40 318 059 211, Email: [email-masked], anspdcp@data=rotection.ro

Slovakia: �=9Arad na ochranu osobných údajov, Hraničná 12, 820 07,=Bratislava 27, +421 2 32313214, Email: [email-masked]
=/div>

Slovenia: Info=macijski pooblaščenec, Dunajska cesta 22, SI-1000 Ljubljana, +38= 1 230 97 30, Email: [email-masked]

Spain: Agencia=Española de Protección de Datos (AEPD), Jorge Juan, 6, 28001 Mad=id, +34 913 996 207, Email: [email-masked]

Sweden: Datain=pektionen, Box 8114, 104 20 Stockholm, +46 08 657 61 00 (Monday, Tuesday, =hursday, Friday: 9:00 to 11:00am; Wednesday: 9:30 to 11:30am), Email: dat=[email-masked]

United Kingdom= Information Commissioner’s Office (ICO), Wycliffe House, Water La=e, Wilmslow, Cheshire SK9 5AF, +44 0303 123 1113, +44 01625 545 745, Email= dat=[email-masked]

TERMS & CONDITIONS OF THE SPG PROGRAM  &nb=p;  TERMS OF USE     =a _label="bbarPrivacyPolicyLink" href="http://email-marriott.com/T/v=000001678fa935a78e518ff4bbc782e8/9bae732e33b544430000021ef3a0bce3/9bae732e=33b5-4443-8f71-b23a1215ad48?__dU__=v0G4RBKTXg2GvMkOJesaYIzG4U7guhmTRETuY=TC-1zsA=" target="_blank" style="color:#525252;">PRIVACY POLICY

©2018 Marriott International, Inc. All Rights Reserved. =tarpoints, SPG, Preferred Guest, Sheraton, Westin, St. Regis, The Luxury=Collection, W, Le Méridien, Tribute Portfolio, Element, Aloft, Four=Points and their respective logos are the trademarks of Marriott Internati=nal, Inc., or its affiliates. Design Hotels is a trademark of Design H=telsTM.