Marriott and NASA Data Breaches: What Travelers Should Know

Few breaches have made travelers think about their data as much as the Marriott Starwood incident. Announced in late 2018, it touched a database of hotel reservations that stretched back years and held details most people assume are tightly protected, such as passport numbers and travel itineraries. Around the same time NASA disclosed that its own employee records had been accessed. This article reviews what happened, what regulators did and what a traveler should do about old breach data in 2026.

1. What happened at Marriott

In November 2018 Marriott International announced that an unauthorized party had accessed the guest reservation database of its Starwood brands. The company said the unauthorized access had begun in 2014, before Marriott acquired Starwood in 2016, and had continued undetected until an internal security tool flagged an unusual database query in September 2018.

Marriott initially said that up to about 500 million guests might be affected, and later revised the figure to roughly 383 million guest records. Depending on the guest, the information included name, mailing address, phone number, email address, passport number, date of birth, gender, arrival and departure information, reservation date and communication preferences. For some guests, payment card numbers and expiration dates were also in the database, stored in encrypted form, though Marriott said it could not rule out that the keys needed to decrypt them were also taken.

A separate Marriott incident was disclosed in 2020 involving a franchise’s login credentials, and another in 2022. The 2018 case remains the best-known because of its size and the sensitivity of the passport data.

2. What regulators and courts did

Data protection regulators examined the case. The UK’s Information Commissioner’s Office announced a fine of about 18.4 million pounds in 2020 after originally proposing a larger figure, saying the company had failed to put appropriate security measures in place. In the United States, a multistate settlement with state attorneys general and an order from the Federal Trade Commission followed in 2024, requiring Marriott to build a stronger information security program and to give customers ways to request deletion of data. You can read about consumer protection enforcement at ftc.gov.

The lesson for consumers is that penalties arrive years after the breach, if at all, and they rarely make individuals whole. The article Do big fines prevent data leaks? looks at this problem.

3. The NASA breach

In December 2018 NASA told its workforce that it had detected a cyber incident affecting servers that stored personally identifiable information of current and former employees. The agency said it did not believe the incident affected any mission or classified systems and began working with federal partners and notifying those affected. The case showed that even organizations with strong technical expertise face breaches, and that data about people tends to outlast the systems that protect it.

4. Why travel data is so valuable to criminals

Travel records are unusually rich. Passport numbers are rarely changed, and they are tied to birth date and nationality. Itineraries reveal when a home is empty. Loyalty numbers can be redeemed or sold. Names of companions and family members provide ready material for phishing and social engineering. Hotel records may include business or government employment details that make targeted attacks easier.

Intelligence analysts have long noted that a single breach rarely tells the whole story, because stolen records can be combined with others over time. Our piece on how long data leaks can affect you explains why risk persists after the headlines fade.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

5. What to do if your data was in a travel breach

Check official notices. Go to the company’s official breach page by typing its address yourself. Do not click email links claiming to offer compensation. Fake notices are a classic phishing lure; see phishing for personal info.

Freeze your credit. A freeze at Equifax, Experian and TransUnion is free and blocks most new-account fraud. Instructions are at IdentityTheft.gov and consumer.ftc.gov.

Monitor accounts and statements. Review bank and card activity weekly. Ask your issuer about alerts for foreign or online transactions.

Be careful with passport information. Never email a passport scan, and be wary of anyone who calls claiming to be from an airline or the State Department. If you believe your passport was stolen or misused, contact the U.S. Department of State through state.gov and the FTC at ReportFraud.ftc.gov.

Change reused passwords. Update your loyalty account password, enable multi-factor authentication and do not reuse the password elsewhere.

Expect targeted phishing. Criminals who know your itinerary may send messages about a booking, a refund or a delayed flight. Verify through the official app.

6. Step: reduce how much of your life is publicly searchable

A breach exposes data that you handed to a company. Public people-search listings make the situation worse, because a criminal who holds your leaked passport number can match it to your current address, relatives and phone number in minutes. Opting out of the largest brokers removes the matching layer. Start with your name search, then use pages such as spokeo.com/optout and suppression.peopleconnect.us. See our guide on scrubbing your information after a breach.

Also consider what you give hotels in the future. Provide only the information required, decline optional profile fields and avoid linking your loyalty account to a long list of third parties. Ask the company to delete old records if you live in a state or country that grants that right.

7. Lessons from the Marriott and NASA cases

First, acquisitions inherit risk. Marriott bought Starwood without discovering that attackers had been inside for two years, which is why security reviews of acquired systems matter. Second, long retention periods multiply harm: data stored for a decade is a decade of potential exposure. Third, passport data deserves stronger controls than loyalty points. Finally, organizations of any size need monitoring that detects unusual database activity, because the Marriott intrusion went unnoticed for years.

For individuals the corresponding lessons are to share the minimum, assume breaches will happen, and prepare by freezing credit and keeping your public footprint small. Our guide to data breach response strategies offers a checklist.

8. A worked example

Priya remembers staying at Starwood hotels for work in 2016. After reading about the breach she checks the official notice, changes her loyalty password, freezes credit at the three bureaus and sets bank alerts. She searches her name, finds her current address on six people-search sites and opts out of the top four that night. A few months later she receives a message claiming to be about a reservation; the sender knows her stay dates, but she goes through the official app and finds no booking, so she reports the message.

9. Myths about hotel and government breaches

“Big companies are secure.” Size does not prevent compromise. “A fine fixes the problem.” Penalties go to regulators, and individuals often get little. “If my card was replaced, I’m safe.” Cards are the easy part; names, birthdays and passport numbers remain. “Old breaches no longer matter.” Criminals reuse old data for years.

10. Three scenarios

Scenario 1: You traveled internationally on business. Treat passport and itinerary data as exposed. Be strict about verifying any request for documents.

Scenario 2: You are a current or former government employee. Use official channels for any notice, freeze credit and watch for impersonation of agency staff.

Scenario 3: You receive a breach notification letter. Check it against the company’s official site, use any free monitoring offered but do not rely on it alone and complete the freeze steps.

11. What to expect: a realistic timeline

Action	Time to do	When it takes effect
Verifying notices	15 minutes	Immediate
Credit freezes	30 minutes	Immediate
Password changes and MFA	30 minutes	Immediate
Broker opt-outs	2 to 4 hours	Days to 4 weeks
Rechecks	15 minutes	Every 60 to 90 days

12. Common mistakes

Clicking compensation links in unsolicited emails.
Relying only on a year of free credit monitoring.
Forgetting that loyalty and travel accounts hold sensitive data.
Leaving a public profile that lets criminals match leaked data to you.
Ignoring older breaches.

13. How Wiperts helps after a breach

Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors your exposure around the clock. That makes it harder for criminals to pair breached travel data with your current address and phone number.

Check what a criminal could match to your leaked data.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

14. Key takeaways

The Marriott Starwood breach exposed hundreds of millions of guest records, including passport numbers for many.
NASA disclosed a separate employee data breach in the same period.
Penalties arrive late; protect yourself with freezes, strong passwords and skepticism.
Reduce your public footprint so leaked data is harder to match to you.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

15. Frequently Asked Questions

What happened in the Marriott breach?

Marriott disclosed in November 2018 that an unauthorized party had accessed the Starwood guest reservation database. Records included names, contact details and, for some guests, passport numbers, travel details and payment card information.

How many people were affected?

Marriott first said up to about 500 million guests might be involved, then revised its estimate downward to roughly 383 million records. The true number of individual people is lower because many guests appear more than once.

Was NASA breached too?

NASA disclosed in December 2018 that servers holding personal information of current and former employees were accessed. NASA said missions were not affected and began notifying people.

What should I do if my passport number was exposed?

Watch for misuse, freeze credit, consider an alert with your passport issuer if you have signs of fraud and never share a passport scan by email. Contact the State Department through its website if you suspect misuse.

Is old breach data still dangerous?

Yes. Names, birth dates, passport numbers and travel patterns stay valuable for years, and criminals combine them with newer leaks to build convincing profiles.

Can I get compensation?

Settlements and regulatory actions have varied by country. Check official notices and the regulators’ websites rather than links in unsolicited emails, which are common phishing lures.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing