WIXLIB

Letter From Our PresidentNovember 20, 2015Dear Starwood Customers:We recently became aware of a malware intrusion that affected some point of sale systems at alimited number of Starwood hotels in North America. Promptly after discovering the issue, weengaged third-party forensic experts to conduct an extensive investigation. We have beenworking closely with law enforcement authorities and coordinating our efforts with the paymentcard organizations to determine the facts. We want to assure you that protecting the security ofour customers’ personal information is a top priority for Starwood.Based on the investigation, we discovered that the point of sale systems at certain Starwoodhotels were infected with malware, enabling unauthorized parties to access payment card data ofsome of our customers. We want you to know that the affected hotels have taken steps to securecustomer payment card information, and the malware no longer presents a threat to customersusing payment cards at our hotels.We have determined the following: The attack targeted certain point of sale systems at a limited number of Starwoodproperties in North America. The locations and potential dates of exposure for eachaffected Starwood property are listed here. The malware affected certain restaurants, gift shops and other point of sale systems atthe relevant Starwood properties. We have no indication at this time that our guestreservation or Starwood Preferred Guest membership systems were impacted. The malware was designed to collect certain payment card information, includingcardholder name, payment card number, security code and expiration date. There is noevidence that other customer information, such as contact information, Social Securitynumbers or PINs, were affected by this issue.

One StarPointStamford, CT 06902United StatesWe sincerely regret any inconvenience this may cause. We take our obligation to safeguardpersonal information very seriously and are alerting affected customers about this incident sothey can take steps to help protect their information. You are entitled under U.S. law to one freecredit report annually from each of the three nationwide consumer reporting agencies. To orderyour free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228.We encourage you to remain vigilant by reviewing your account statements and monitoringyour free credit reports. If you believe your payment card may have been affected, pleasecontact your bank or card issuer immediately.In addition, we have arranged with AllClear ID to offer identity protection and credit monitoringservices to affected Starwood customers for one year at no cost to them. The Reference Guideprovides information on registration and recommendations by the U.S. Federal TradeCommission on the protection of personal information.If you have any questions or would like more information, please call 1-855-270-9179 (U.S. andCanada) or 1-512-201-2201 (International), Monday through Saturday, 8:00 am to 8:00 pmCST.Again, we sincerely apologize for any inconvenience this issue may cause.Sincerely,Sergio RiveraPresident, The Americas

One StarPointStamford, CT 06902United StatesReference GuideWe encourage affected customers to take the following steps:Order Your Free Credit Report. To order your free credit report, visitwww.annualcreditreport.com, call toll-free at 1-877-322-8228, or complete the Annual CreditReport Request Form on the U.S. Federal Trade Commission’s (“FTC”) website atwww.consumer.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281,Atlanta, GA 30348-5281. The three consumer reporting agencies provide free annual creditreports only through the website, toll-free number or request form.When you receive your credit report, review it carefully. Look for accounts you did not open.Look in the “inquiries” section for names of creditors from whom you haven’t requested credit.Some companies bill under names other than their store or commercial names. The consumerreporting agency will be able to tell you when that is the case. Look in the “personalinformation” section for any inaccuracies in your information (such as home address and SocialSecurity number). If you see anything you do not understand, call the consumer reportingagency at the telephone number on the report. Errors in this information may be a warningsign of possible identity theft. You should notify the consumer reporting agencies of anyinaccuracies in your report, whether due to error or fraud, as soon as possible so theinformation can be investigated and, if found to be in error, corrected. If there are accounts orcharges you did not authorize, immediately notify the appropriate consumer reporting agencyby telephone and in writing. Consumer reporting agency staff will review your report with you.If the information can’t be explained, then you will need to call the creditors involved.Information that can’t be explained also should be reported to your local police or sheriff’s officebecause it may signal criminal activity.Identity Protection and Credit Monitoring Services. Starwood has arranged with AllClear IDto offer affected customers identity protection, credit monitoring and fraud assistance servicesfor 12 months at no cost to them. These services start on November 20, 2015, and will beavailable at any time during the next 12 months. A customer is eligible for the services listedbelow if the customer used a payment card at one of the affected Starwood properties during arelevant time period. The locations and potential dates of exposure for each affected Starwoodproperty are listed here.

AllClear SECURE: This service provides affected customers with a dedicated investigator tohelp them recover financial losses and restore their credit and identity. Affected Starwoodcustomers are automatically eligible to use this service – there is no action required ontheir part to enroll. Affected customers may receive this fraud assistance service by calling 1855-270-9179.AllClear PRO: This service offers additional layers of protection to U.S. residents, includingcredit monitoring and a 1 million identity theft insurance policy. Please click here or call 1855-270-9179 to learn more and sign up for this service.AllClear PLUS Canada: For additional protections, Canadian residents may enroll in AllClearPLUS Canada, which includes identity theft monitoring. To use this service, you will need toprovide certain information. Please click here or call 1-855-270-9179 to learn more and sign upfor this service.AllClear Global Identity Repair: Customers residing outside the U.S. and Canada may call 1512-201-2201 or click here for information about AllClear SECURE and AllClear Global IdentityRepair services.Report Incidents. If you detect any unauthorized transactions in a financial account, promptlynotify your payment card company or financial institution. If you detect any incident of identitytheft or fraud, promptly report the incident to law enforcement, the FTC and your state AttorneyGeneral. If you believe your identity has been stolen, the FTC recommends that you takethese steps: Place an initial fraud alert.Order your credit reports.Create an FTC Identity Theft Affidavit by submitting a report about the theft athttp://www.ftc.gov/complaint or by calling the FTC.File a police report about the identity theft and get a copy of the police report or thereport number. Bring your FTC Identity Theft Affidavit with you when you file the policereport.Your Identity Theft Report is your FTC Identity Theft Affidavit plus your police report.You may be able to use your Identity Theft Report to remove fraudulent informationfrom your credit report, prevent companies from refurnishing fraudulent information to aconsumer reporting agency, stop a company from collecting a debt that resulted fromidentity theft, place an extended seven-year fraud alert with consumer reporting

agencies, and obtain information from companies about accounts the identity thiefopened or misused.You can contact the FTC to learn more about how to protect yourself from becoming a victim ofidentity theft and how to repair identity theft:Federal Trade CommissionConsumer Response Center600 Pennsylvania Avenue, NWWashington, DC 205801-877-IDTHEFT (438-4338)www.ftc.gov/idtheft/Consider Placing a Fraud Alert on Your Credit File. To protect yourself from possibleidentity theft, consider placing a fraud alert on your credit file. A fraud alert helps protect youagainst the possibility of an identity thief opening new credit accounts in your name. When amerchant checks the credit history of someone applying for credit, the merchant gets a noticethat the applicant may be the victim of identity theft. The alert notifies the merchant to takesteps to verify the identity of the applicant. You can place a fraud alert on your credit report bycalling any one of the toll-free numbers provided below. You will reach an automatedtelephone system that allows you to flag your file with a fraud alert at all three consumerreporting agencies. For more information on fraud alerts, you also may contact the FTC asdescribed above.EquifaxExperianTransUnionEquifax Credit Information Services,Inc.P.O. Box 740241Atlanta, GA 30374Experian Inc.P.O. Box 9554Allen, TX 75013TransUnion LLCP.O. Box 2000Chester, PA m

Consider Placing a Security Freeze on Your Credit File. You may wish to place a “securityfreeze” (also known as a “credit freeze”) on your credit file. A security freeze is designed toprevent potential creditors from accessing your credit file at the consumer reporting agencieswithout your consent. There may be fees for placing, lifting, and/or removing a security freeze,which generally range from 5- 20 per action. Unlike a fraud alert, you must place a securityfreeze on your credit file at each consumer reporting agency individually. For more informationon security freezes, you may contact the three nationwide consumer reporting agencies or theFTC as described above. As the instructions for establishing a security freeze differ from stateto state, please contact the three nationwide consumer reporting agencies to find out moreinformation.The consumer reporting agencies may require proper identification prior to honoring yourrequest. For example, you may be asked to provide: Your full name with middle initial and generation (such as Jr., Sr., II, III)Your Social Security numberYour date of birthAddresses where you have lived over the past five yearsA legible copy of a government-issued identification card (such as a state driver’slicense or military ID card)Proof of your current residential address (such as a current utility bill or accountstatement)For Maryland Residents. You can obtain information from the Maryland Office of the AttorneyGeneral about steps you can take to avoid identity theft. You may contact the MarylandAttorney General at:Maryland Office of the Attorney GeneralConsumer Protection Division200 St. Paul PlaceBaltimore, MD 21202(888) 743-0023 (toll-free in Maryland)(410) 576-6300www.oag.state.md.usFor Massachusetts Residents. You have the right to obtain a police report and request asecurity freeze as described above. The consumer reporting agencies may charge you a fee ofup to 5 to place a security freeze on your account, and may require that you provide certain