Marriott has provided additional information on their massive data breach. We’re supposed to be comforted that it’s ‘only’ 383 million and not 500 million records that were accessed – Skift covers this as “Marriott Says Data Breach Not as Bad as Originally Disclosed” which is pretty priceless.

• They had said 500 million records had been hacked. Now they say it’s not more than 383 million (this is supposed to be good news). It was never 500 million people but they’re emphasizing the point that many guests have multiple stays and therefore fewer than 383 million people had their data stolen. Marriott isn’t telling us how many people though, which should be concerning in its own right.

  

• 5.25 million unencrypted passport numbers were accessed and 20.3 million encrypted passport numbers. “There is no evidence that” the master encryption key was accessed, compromising those 20 million additional passports, but Marriott isn’t saying the encryption key wasn’t accessed. It’s shocking that passport numbers were stored as unencrypted text.

• There’s going to be a process to look up whether your passport was compromised. Eventually this will be online. And since Marriott wants to remind you that it was the Starwood database (that they’ve been managing) so the lookup tool will be at https://info.starwoodhotels.com and not on a Marriott.com domain. Recall of course that Marriott has said they will pay for new passports only for those that are already actual victims of compromised data being used and not ‘merely’ for the 5 million people whose passport numbers were irresponsibly stored and stolen.

• 8.6 million payment cards were accessed these were encrypted and only 354,000 were unexpired as of September 2018 but of course Marriott previously said the breach had been ongoing prior to that time. In addition “Marriott is undertaking additional analysis to see if payment card data was inadvertently entered into other fields and was therefore not encrypted.” They believe the number involved is less than 2000.

• Don’t worry we no longer use the Starwood reservation database as though this has anything whatsoever to do with the data breach, Marriott has transitioned hotels onto their own property management system as-planned. Of course the Starwood data warehouse is still live – fortunately – because many of us still have issues with our merged loyalty program accounts.

  GOOD NEWS: There is an independent copy of the database with our lifetime stay histories. We just need to get the hackers to provide access and we can fix the problems with Marriott's SPG integration! https://t.co/O3h40jDkQ7

  — gary leff (@garyleff) November 30, 2018

Marriott still hasn’t told us anything about their notes on your as as a customer that were taken.