Morgan Stanley analyst Thomas Allen said the 6% pullback in Marriott (MAR) shares, which implies about $2.4 billion of lost equity value, is an overreaction, contending that a 2%-3% impact would be more appropriate.

Data breaches typically cost $1 per customer in notification and other services, according to Insurance Insider, and he estimates potential fines and/or settlements of about $200M for Marriott. Insurance Insider also reports that sources suggest the company has about $300 million of cyber insurance coverage to partially offset losses, Allen noted.

If it is also assumed that Marriott takes a 1% hit to RevPAR, which is about what Target (TGT) saw in terms of comparable store sales impact in the wake of its own data breach, that amounts to about $580 million in stock value, Allen tells investors. If Marriott RevPAR is in fact impacted 1% by the breach, he estimates this implies about 55c and 35c per share of lost value for Marriott-exposed lodging REITs Host Hotels (HST) and DiamondRock (DRH), respectively, or about 3%. Allen has an Equal Weight rating and $123 price target on Marriott shares.