I got hacked today for the tune of 225,000 points. Initially I had gotten an email (around 11:30am) saying my address had changed. So I went online and checked and sure enough, there was an address from Singapore on my account (I live in SoCal). I suspected something wrong, so I immediately changed it back to my address, changed my password and called customer service. Their response was that maybe someone had mistakenly given my account number while requesting an address change and since my point total was unchanged, I figured that was probably the case. As a precaution I asked the rep to annotate in my account that any future acct changes or point redemptions should prompt a DOB and PIN request. Then at around 4:30 pm I get another email from HHonors with an order confirmation. It was the redemption of 225,000 points for the two $200 GC's. Called customer service again to report it and was given a case number. Does anyone know if Hilton returns the points and if so, how long will it take?