TalkTalk also admitted in August that some personal details had not been encrypted after another breach affecting nearly 500,000 customers.
It declined to say how the hack had occurred or why the e-mail addresses had not been encrypted.
Although the laptop was password protected, the information had not been encrypted, which could give skilled hackers full access to the contents.
Subsequently, NASA sent letters to about 10,000 current and former employees and contractors, warning them that the laptop had not been encrypted.
"Even in cases where Wi-Fi networks had not been encrypted by their owners, German courts have been pretty consistent in saying that it was still illegal to access another's network without their permission," Mr. Ferner said.
When the expert tested the form, using software that captures data sent over the Web, he could clearly see that the sample Social Security number he had submitted had not been encrypted.
Referring to the £250,000 penalty imposed on Sony Corporation after it was found that leaked PlayStation customer data had not been encrypted, he said: "People have got to take this seriously".
Sony said that user names and passwords to the network had not been encrypted but that the credit card information it had for about 10 million users had been and that there was yet no evidence that those data had been taken.
Cryptographers have long sought to implement a system they call "fully homomorphic encryption," in which a user can encrypt data into indecipherable strings of numbers, do math with those strings, and then decrypt the results to get the same answer he or she would have if the data hadn't been encrypted at all.
Although credit card information was encrypted, Marriott has not been able to rule out the possibility that the encryption keys were also stolen.
This system, which has not been used before, is rife with security problems, including the possibility of hacking the e-mailed ballots, which will not be encrypted.
