Marriott Starwood data breach: what guests should know
2 min read · Updated October 15, 2026
In November 2018 Marriott disclosed unauthorised access to the Starwood guest reservation database, dating back to 2014. It first reported up to 500 million guests, later revised to about 383 million records. Exposed data included names, contact details and, for some guests, passport numbers. Monitor for fraud and stay alert to phishing.
What happened
Marriott said an unauthorised party had accessed the guest reservation database of its Starwood brands. The intrusion had begun years earlier and was discovered in 2018. The company later lowered its estimate of affected guest records.
What was exposed
- ✓Names, mailing addresses, phone numbers and email addresses.
- ✓Travel and reservation details.
- ✓For some guests, passport numbers and payment card details.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Specific risks
Passport numbers and travel history can support identity fraud and very convincing travel-themed phishing. Watch for fake booking confirmations and requests to ‘verify’ reservations.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
- ✓If a passport number was involved, follow the guidance from the company and your issuing authority.
Frequently asked questions
Did the breach include passwords?+
The main exposure was reservation and personal data. Change your loyalty-account password anyway if you reused it.
Should I replace my passport?+
Follow the company’s notice and your government’s guidance. Not every affected guest needs to.
How can I check for email exposure?+
A breach lookup can show if your address appears in known incidents.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.