2018Data breach
Marriott (Starwood) guest database breach
Intrusion from 2014, discovered September 2018
Attackers had been inside the Starwood Hotels guest reservation system since 2014, two years before Marriott acquired Starwood, and were not discovered until 2018. The UK Information Commissioner's Office fined Marriott under the GDPR, and in 2024 the US FTC finalised an order requiring Marriott and Starwood to run a comprehensive information security programme.
- Victim
- Marriott International (Starwood guest reservation database)
- Sector
- Hospitality
- Public attribution
- The ICO described the attack as coming from an unknown source.
Impact
The ICO said about 339 million guest records worldwide were affected and fined Marriott 18.4 million pounds; the FTC said three breaches affected more than 344 million customers.
Root cause
A long-undetected compromise in an acquired company's systems, with insufficient monitoring and security of the guest database, according to the ICO.
Lessons learned: the controls it teaches
- Perform security due diligence and compromise assessment during mergers and acquisitions.
- Monitor privileged access to databases holding personal data.
- Encrypt sensitive fields such as passport numbers and limit retention.