An unwelcome guest

https://www.cbj.ca/marriott-apologizes-for-data-breach/

What happened:

   In September 2018 information surfaced that the famous Marriott hotel chain was hacked. They immediately started an investigation and found out that the Starwood guest reservation databased was in fact hacked. An “unwelcomed guest” copied information about millions of people, 500 million to be more precise…a lot, huh? The information that was stolen included: names, mailing addresses, phone numbers, email addresses, passport numbers, dates of birth, gender, arrival and departure information, reservation dates, and communication preferences. As that wasn’t bad enough, over 9 million encrypted payment card numbers and payment card expiration dates were also copied by the hackers. For people that do not know Starwood brands include W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts among others.

Thorough background check?

   What Zalfa did not mention in her article was that Starwood hotels were leaking data since 2014, so it seems. Marriott hotels bought Starwood in 2016. It is pretty clear that some people did not do their work properly, I mean how can you miss something like this?!

Could this crisis be avoided?

   YES! In my opinion this crisis could’ve been easily avoided if the IT department or who ever was in charge spotted this leakage. According to Uhrich and Flöter (2014) the most frequent crisis that implicate low-to-high responsibility are the victim crisis, the accidental crisis, and the preventable crisis. They further explain that a preventable crisis is a crisis that is caused by inappropriate actions by the company, which could have been avoided. And in this case, it could’ve been! Questions about responsibility arise, which can result in serious reputational threats for the company (Uhrich & Flöter, 2014) and according to Coombs andHolladay (2008) reputations are valuable resources. 

twitter.com

The response

   After determining with certainty that indeed the data that was stolen was in fact the Starwood reservation database, Marriott issued a press release in which they stated what happened and which measures they will take to help the authorities and the guests affected by this incident. 

Moreover, the press release included a statement made by Arne Sorenson, CEO of Marriott:

 “We deeply regret this incident happened. We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”

Schafradd, Van Zoonen, & Vehoeven (2016) determined that ‘controversy’, ‘negative consequences', and ‘elite organizations’ as news factors in corporate press releases increase the chance on succession in news media. We can say that this press release has it all. Accordingly, the media reported  on it. They say Marriott did not properly apologized, by not mentioning the word "sorry”, which indeed they did not. So, I can assume that they felt sorry for what happened to the guest but did not want to take responsibility. Furthermore, they posted on twitter trying to shift the responsibility towards Starwood. I agree with Zalfa on the fact that they are in fact to blame, but as she mentioned, Starwood (as of 2016) is a subsidiary of Marriott. 

Twitter.com

According to Nijkrake, Gosselt, and Gutteling (2015) corporate communication can lessen negative media coverage and manage perceptions. However, it may be that one of the reasons they did not apologized at first is that: when an organization offers an apology, it can be susceptible to financial loss and lawsuits, since the apology can be used as evidence (Coombs & Holladay, 2008). 

In the end…

   After facing a class action suit and being under investigation, CEO Arne Sorenson apologized in front of the US Senate: 

“As a company that prides itself on taking care of people, we recognize the gravity of this criminal attack on the Starwood guest reservation database and our responsibility for protecting data concerning our guests. To all of our guests, I sincerely apologize.” 

Given the circumstances, and the serious consequences that this crisis left behind, saying sorry was imperative.

About the Author:

Alexandra Smigelschi is a 23-year-old student, currently enrolled in the Master at University of Amsterdam. She is doing the persuasive master track, which she enjoys very much. Coming from Bucharest, Romania she faced a completely different environment to what she was used to, but I am pleased to say she managed to  overcome all the challenges. 

REFERENCES:

Coombs, W. and Holladay, S. (2008). Comparing apology to equivalent crisis response strategies: Clarifying apology's role and value in crisis communication. Public Relations Review, 34(3), pp.252-257.

Nijkrake, J., Gosselt, J. and Gutteling, J. (2015). Competing frames and tone in corporate communication versus media coverage during a crisis. Public Relations Review, 41(1), pp.80-88.

Schafraad, P., van Zoonen, W. and Verhoeven, P. (2016). The news value of Dutch corporate press releases as a predictor of corporate agenda building power. Public Relations Review, 42(3), pp.451-458.

Uhrich, S. and Flöter, T. (2014). Sponsor Response Strategies for Avoiding Negative Brand Image Effects in a Sponsorship Crisis: The Comparative Efficacy of Apology, Denial and No Comment. Marketing ZFP, 36(4), pp.257-266.