and according to the article: "It said an internal investigation found an attacker had been able to access the Starwood network since 2014." 4 years of access, surely the attacker didn't manage to get hold of these keys