Check out the latest Marriott earnings call transcript.
What happened
Shares of Marriott (MAR 2.52%) jumped today, closing out the session with 6% gains amid a broad market rally, after the company provided an update on a previously disclosed data breach. The hotel chain now believes a smaller number of guests had information compromised.
So what
Marriott had disclosed a security breach in late November, and initially estimated that upwards of 500 million guests who had made a reservation at a Starwood hotel could have been impacted. The news sparked several class-action lawsuits and Marriott vowed to pay for new passports for any guest who experienced fraud due to the incident. The update today says that the "upper limit" for the number of affected records compromised is approximately 383 million, far less than previously thought. Some of those records could also be duplicates, so the number of unique guests affected is expected to be fewer still.
Image source: Marriott.
Marriott also said over 25 million passport numbers were accessed, including 20.3 million that were encrypted and 5.25 million that were not encrypted. There were 8.6 million encrypted payment cards accessed as well, the vast majority of which were expired -- only about 354,000 cards were still valid as of September 2018. The company does not believe the hackers were able to access any of the encryption keys necessary to decrypt encrypted data.
Now what
The update reduces the potential liability and other costs -- Marriott had offered a free year of WebWatcher, a service that monitors sites for potentially compromised personal information, to affected guests, for example -- that the company could face related to the breach, as the number of affected guests and compromised records is significantly lower than previously believed. Much of the data was also encrypted, which should also limit the risk of the information being used fraudulently.
The company also said it has completed the phase out of Starwood's reservation database -- which was the system that was compromised in the first place -- and has transitioned all Starwood reservations to its Marriott system. The phase out was part of Marriott's broader integration efforts following its acquisition of Starwood Hotels, which closed in 2016.
