Marriott: 5 million passport numbers, unencrypted
Marriott’s updated breach numbers include millions of unencrypted passport numbers. Data you must keep, you must protect.
Last week Marriott updated the numbers from its Starwood reservation breach: up to 383 million guest records, including about 5.25 million passport numbers stored without encryption, plus millions of encrypted card numbers.
Hotels collect passports because many countries require it. Fine. But keeping them for years, unencrypted, in a booking system that was breached since 2014, is a choice.
For guests: watch for phishing that mentions your stays, and ask your government what to do if you’re worried about your passport number.
For any company holding ID documents:
- Keep them only as long as the law requires, then delete.
- Encrypt the fields themselves, not just the disk.
- Limit who and what can read them. Most systems never need the full number.
- After buying a company, check its systems before connecting them to yours. Starwood was acquired with the breach already inside.