The data breach that Marriott International Inc. recently revealed could lead to direct cyber incident losses of between $200 million and $600 million, catastrophe risk modeling firm AIR Worldwide said.
The loss estimates are based on the assumption that the breach may have potentially compromised information on about 500 million guests. In November, the hotelier said unauthorized access to the Starwood guest-reservation database network may have compromised guest information including names, mailing addresses, phone numbers, email addresses and passport numbers.
AIR's modeled loss estimates include first- and third-party losses directly related to the security breach, including notification costs, forensics, credit monitoring, replacement of credit cards and any liability covered under an affirmative cyber policy. The estimates exclude the impact of any insurance coverages that Marriott may use to recover losses.
AIR Worldwide is a Verisk Analytics Inc. business.