Just in case you also received an email telling you that your account information is currently secure, but a "small" number of other people's information was accessed, so you should click the link to change your password just in case...
This email MAY BE TRUE. I logged onto marriott.com, found the customer care number and called. They did send emails to "some" of their members. It is ALWAYS a good idea to type in the web address yourself, and NEVER click on links within emails that claim to be security related, or are asking for login and account information.
The email I received said:
The security of your Marriott Rewards® member account is of the utmost importance to us. There have recently been attempts made to gain unauthorized access to a small number of members' online accounts. Although your account was not included in these attempts, as a precaution, we ask that you visit Marriott.com and change your password as soon as possible to assist us in ensuring the security of your account:
Our Data Privacy and Protection team has been working diligently to implement safeguards to block these attempts and maintain the ongoing security of all member accounts.
These types of online attacks become possible when individuals use the same email address and password combination for multiple online accounts. The email address and password combination becomes more susceptible to being collected via external sources and then used in an attempt to gain unauthorized access to other online accounts, such as your Marriott Rewards account.
If you have any questions, please call Marriott Rewards Guest Services at 800-952-8876 for assistance.
We take this matter very seriously as we have a long-standing commitment to protect the privacy of the personal information that our guests entrust to us. Thank you for your prompt attention to this important notice.
Marriott Rewards Guest Services