Marriott International Inc. (MAR) said Friday that the massive data hack that hit the hotel giant in late November allowed data thieves to grab a hold of as many as 5.25 million unencrypted passport numbers of guests.
The hotel giant also modestly downsized the estimated hack, from around 500 million records to as many as 383 million.
And, Marriott said, it's unlikely 383 million "unique guests" had their data stolen because there appears to be "multiple records" for guests.
"The company has concluded with a fair degree of certainty that information for fewer than 383 million unique guests was involved, although the company is not able to quantify that lower number because of the nature of the data in the database," said Marriott in a statement.
That bit of good news appears to have pleased investors, as shares of the hotel chain traded up about 5.6% on Friday to $107.46.
Still, for comparison, the entire U.S. population is about only about 328 million people.
Total theft of credit card and passport information, most of which was encrypted, is a "relatively small percentage of the overall total records involved," said the company.
About 8.6 million card numbers were believed to have been stolen, but the hotel suspects only a couple thousand were possibly not encrypted. It does not believe the hackers have keys to the encryption codes.
The hotel revealed in November that chain's Starwood guest reservation database was hacked, and since it has been working with company security staff as well as an outside forensics and analytics investigation team, said the hotel.
"As we near the end of the cyber forensics and data analytics work, we will continue to work hard to address our customers' concerns and meet the standard of excellence our customers deserve and expect from Marriott," said Arne Sorenson, Marriott's president and chief executive.Marriott's Starwood brands include W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels, as well as branded timeshare properties, Sheraton Vacation Club, Westin Vacation Club, The Luxury Collection Residence Club, St. Regis Residence Club, and Vistana) are also included.