Marriott breach: State Department says don’t panic over stolen passport numbers

As many as 500 million guests may have had their personal information disclosed by a data breach in Marriott’s Starwood guest reservation database. While some guests “only” had their names and addresses accessed, around 327 million guests had some combination of the following information compromised: name, mailing address, phone number, credit card information, email address, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date, and passport number.

That last one might give you pause. Passport numbers are especially sensitive, and you may now be wondering if yours is being passed around on the dark web, waiting to become the alias of some highly trained Russian assassin.

We reached out to the U.S. State Department for answers. While the department says it’s aware that some individuals’ passport numbers may have been disclosed in the Marriott/Starwood breach, it is urging consumers not to panic. For one thing, none of the State Department’s records or IT systems connect directly to Marriott’s records or systems, so hackers didn’t stumble on a backdoor to the State Department’s computers.

Also, while it’s not great that passport numbers were disclosed, according to a State Department official, passport numbers aren’t all that powerful on their own: No one can travel internationally using only a U.S. passport number. Travelers must present an original, physical version of a U.S. passport book or U.S. passport card upon entering a foreign country and when returning to the United States from a foreign country. Plus, no one can access the Department’s records or obtain copies of a U.S. citizen’s records by using a passport number alone.

The State Department official also stressed that U.S. passports are a lot bigger than just their number. They are, in fact, “highly secure documents with numerous security features designed to prevent successful counterfeiting.”

Of course, none of this means that the Marriott data breach is not hugely concerning, and there are steps you can take right now to protect yourself. We wrote earlier about how placing a credit freeze with the three major credit bureaus can prevent ID theft. Also, if you suspect your passport number has been comprised, consider reporting it as lost or stolen to get a new number.

Updated to clarify: If you report your passport lost or stolen, you will need to pay for a new one. Per the State Department, “if an individual reports their passport lost or stolen, they must then submit a new passport application and pay all applicable fees to receive a new passport book or card with a new number.” So write a check with one hand, while shaking your fist at the people behind the data breach with the other.