Update: New York State Attorney General Barbara Underwood has launched an investigation into the hack of Starwood's guest registration system announced Friday morning.

And while one analyst who appeared on CNBC Friday morning said he didn't expect the scandal to have a long-term impact on Marriott shares, analysts at Cowen have warned that it could impact enrollment in Starwood's loyalty program, which is seen as one of its most successful assets.

* * *

This is terrible news for Marriott shareholders (and great news for the VC backers of Airbnb).

Marriott shares have fallen more than 2% in premarket trading after the hotel chain announced news of a massive data breach of its guest registration system at Starwood hotels, the hotel chain that it purchased in September 2016. 

According to a press release, Marriott believes the compromised database had information on up to 500 million guests who had made a reservation at a Starwood property. The information compromised includes sensitive details including their passport numbers (for those who booked at foreign hotels) as well as name, date of birth, dates of their reservation, email address and mailing address. The infiltration dates back to at least September 2014 - before Starwood was purchased by Marriott - and continued through September of this year. Payment card numbers and payment card expiration dates belonging to some of those affected were also stolen, but the payment card numbers were encrypted using Advanced Encryption Standard encryption.

To put these numbers in context, going by sheer volume, the Starwood Hotels hack would be the largest since Yahoo announced that information belonging to roughly 3 billion users had been taken by hackers. Marriott was alerted to the breach when a security tool notified the company of an attempted intrusion back in September. After an investigation, the company learned that hackers had been accessing data from its guest registration system and had even attempted to remove and encrypt it.

Just like Equifax and other major data breaches before it, news of the hack is bound to raise a number of questions about what Marriott knew and when, and whether Starwood should have been aware of and disclosed this information before the IPO, as well as exactly what the fallout for those affected might be.

Marriott has informed the UK Information Commissioner's office about the hack of its global reservation system.

"We have received a data breach report from Marriott Hotels, involving its Starwood Hotels and will be making enquiries," the regulator said. It asked any concerned customers impacted by the hack to report any suspicious activity.

Read the full release below:

BETHESDA, Md.--(BUSINESS WIRE)--Marriott has taken measures to investigate and address a data security incident involving the Starwood guest reservation database. On November 19, 2018, the investigation determined that there was unauthorized access to the database, which contained guest information relating to reservations at Starwood properties* on or before September 10, 2018.

On September 8, 2018, Marriott received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database in the United States. Marriott quickly engaged leading security experts to help determine what occurred. Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014. The company recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it. On November 19, 2018, Marriott was able to decrypt the information and determined that the contents were from the Starwood guest reservation database.