https://www.cnet.com/news/marriott-data-breach-impacts-500-million-starwood-hotel-guests/

An internal investigation found that its network was first breached in 2014, and that "an unauthorized party had copied and encrypted information." For around 327 million of those impacted, that data included names, addresses, phone numbers, emails, passport numbers and travel details.

Marriott noted that some of the stolen information also included payment card numbers and expiry dates. Even though this data is normally encrypted, the company said the encryption key data might've been stolen too.