Marriott Vacation Club International is missing backup tapes with personal information for 206,000 customers, owners and associates, the company disclosed on Wednesday.
A spokesman for the timeshare division of Marriott International Inc. told eWEEK that the tapes—which went missing from the companys Orlando, Fla., corporate office—may have contained addresses, credit card numbers and, in some cases, Social Security numbers.
According to the spokesman, it is unknown whether the data on the tapes was encrypted. Although MCVI does have a policy on encrypting such information, he declined to discuss whether that policy dictates that Social Security numbers or credit card numbers be encrypted.
“It all depends on what type of information that was on [the tapes],” he said. “There is a policy, but its not something we can discuss” at this time, he said.
At this point, MCVI hasnt heard of any of the concerned individuals having been victimized by identity theft, the spokesman said.
The company discovered the missing tapes on Nov. 13 and has since been working with federal agencies including the Secret Service to investigate the disappearance, to search for the tapes and to prevent a recurrence of the loss. The investigation is ongoing.
MVCI is aware of the date and the window of time that the tapes went missing. “Weve evolved our own process and checklist of when they were not where they were supposed to be, and we started the process to see if we could relocate them and identify what type of information was on them, and so on,” the spokesman said.
At this point, the company doesnt know what type of encryption might have been on the backup tapes, nor what format they were in that might prevent the reading of the tapes, the spokesman said.
But according to a company statement released on Wednesday, the tapes can only be read with specialized equipment. The spokesman described the required reading equipment as being commercial-level database hardware, as opposed to something being available on a typical consumer-level computer or a home system.
MVCI sent notification letters to affected individuals on Dec. 24. The letters, sent by snail mail, offered affected individuals the opportunity to enroll in a credit monitoring service at no cost. After enrolling in the service, the individuals would be notified of credit report activity so as to take action if necessary.
Those who were impacted include timeshare owners, timeshare customers and associates. The company has set up a hotline for affected individuals at (800) 952-8145, as well as a site, at www.vacationclub.com/datasecurity.
Check out eWEEK.coms for the latest database news, reviews and analysis.
