Starwood had been losing reservations data since 2014

It appears, in the more detailed information now coming to light that:

Marriott first identified a problem on 8 September 2018
After investigation, it turned out that there had been unauthorised access to the Starwood database since 2014
On 19 November, Marriott decrypted the data and found that it was the Starwood reservations system records
Payment card numbers and payment card expiration dates were taken, but the payment card numbers were encrypted using Advanced Encryption Standard encryption (AES-128). There are two components needed to decrypt the payment card numbers, and at this point, Marriott has not been able to rule out the possibility that both were taken.
Marriott is offering free WebWatcher enrollment

Marriott has created a call centre to handle questions – the numbers are here: