Hotel chain Marriott has failed to secure millions of unencrypted passport numbers.

Marriot says customers' data was accessed in a hack of the Starwood reservations system that started about four years ago but was only detected in September 2018.

Starwood’s owner Marriott says that “fewer than 383 million unique guests” were involved.

“Marriott now believes that approximately 5.25 million unencrypted passport numbers were included in the information accessed by an unauthorised third party,” it said in a statement.

“The information accessed also includes approximately 20.3 million encrypted passport numbers.

“There is no evidence that the unauthorised third party accessed the master encryption key needed to decrypt the encrypted passport numbers.”

The hotel chain says it “now believes that approximately 8.6 million encrypted payment cards were involved in the incident.” 

“Of that number, approximately 354,000 payment cards were unexpired as of September 2018,” it said.

“There is no evidence that the unauthorised third party accessed either of the components needed to decrypt the encrypted payment card numbers.”

The company is in the process of checking whether payment card data was incorrectly input into other fields of the reservation system, and so may not have been encrypted.

“Marriott is undertaking additional analysis to see if payment card data was inadvertently entered into other fields and was therefore not encrypted,” it said.

“Marriott believes that there may be a small number (fewer than 2000) of 15-digit and 16-digit numbers in other fields in the data involved that might be unencrypted payment card numbers.

“The company is continuing to analyse these numbers to better understand if they are payment card numbers and, if they are payment card numbers, the process it will put in place to assist guests.”

Marriott bought Starwood in September 2016 and has been running Starwood’s booking and reservations on a platform separate to its own.

“With the completion of the reservation systems conversion undertaken as part of the company’s post-merger integration work, all reservations are now running through the Marriott system,” it said.