“We’ve identified the vulnerability, shut it down and are vigorously pursuing the matter with law enforcement. We sincerely apologize for this inconvenience,” the company wrote.

TripAdvisor said it is was still investigating how the theft occurred, noting that no passwords or credit card information was taken.

“The portion of our membership that was impacted may receive some unsolicited emails (SPAM) as a result,” the company said. “No passwords were taken, and any and all password information is secure. TripAdvisor does not collect members’ credit card or financial information, and we never sell or rent our member list.”

Hat tip to Tnooz, which pointed out that the company’s systems are somewhat vulnerable.