The massive data breach disclosed by Marriott in November 2018 has cost the world’s biggest hotel chain only $3 million so far, as insurance covered most of the costs associated with the hack.

In its 2018 earnings report, Marriott said it “recognized $25 million of insurance proceeds” related to the incident, with an additional $3 million in net expenses. Marriott’s net income rose 23% YoY in Q4 to $497 million. Earnings before interest, taxes, depreciation, and amortization (EBITDA) totaled $864 million.

“In the 2018 fourth quarter, the company incurred $28 million of expenses and recognized $25 million of insurance proceeds related to the data security incident,” the company said in a press release. “The $3 million of net expenses are reflected in either the Reimbursed expenses or Merger-related costs and charges lines of the Statements of Income, which have been excluded from adjusted net income, adjusted EPS and adjusted EBITDA.”

CEO Arne M. Sorenson said the integration of Starwood (whose acquisition was key to the embarrassing breach) is nearly complete, and that customers are receiving “meaningful benefits” as a result of the new Marriot Bonvoy loyalty brand.

It remains to be seen what other costs Marriott will incur, including reputational damage, as a result of the breach. The incident, four years in the making, was presumably caused by an APT, where adversaries typically conduct sophisticated hacks while remaining undiscovered for long periods of time.