Marriott-Starwood: Three Breaches, an ICO Fine, a 344M-Record Order

The Marriott-Starwood file is the reference case for hospitality data breaches at scale. An intrusion into the Starwood network persisted from 2014, well before Marriott's acquisition, and was only detected in 2018. It exposed records on up to about 500 million guests, passport numbers included. Two more incidents followed, and regulators on both sides of the Atlantic ultimately drew the line: the UK's data watchdog imposed then-record GDPR penalties, and the US Federal Trade Commission levied a long-haul security order.

The facts, in order

On Nov. 30, 2018, Marriott disclosed that the Starwood guest reservation database had been accessed without authorization. The alert came from an internal security tool on Sept. 8, 2018; the investigation found unauthorized access to the Starwood network dating to 2014; on Nov. 19 Marriott decrypted the exfiltrated data and sized the damage at up to approximately 500 million guests, about 327 million of them with name, mailing address, phone, email, passport number, Starwood Preferred Guest account data, date of birth, gender and arrival or departure information, per the official release. The intrusion predated Marriott's 2016 acquisition of Starwood.

A second breach was disclosed by Marriott on March 31, 2020: about 5.2 million guests, reached through the login credentials of two employees at a franchise property, with activity believed to have started in mid-January and the intrusion identified around the end of February. No payment cards, passports or passwords in that batch.

A technical aggravating detail surfaced only on April 17, 2024, in an update appended to the 2018 release: Marriott had believed the payment card numbers and certain passport numbers were protected with AES-128 encryption; the company later determined they were instead protected with the SHA-1 hashing function, which is considerably weaker.

The UK regulator strikes

On Oct. 30, 2020, the Information Commissioner's Office fined Marriott £18.4 million for GDPR failures covering up to 339 million guests, including about 7 million records in the UK, the BBC reported. The ICO had proposed a £99 million penalty in 2019; the final figure reflected, among other things, the improvements Marriott made after the incident. Commissioner Elizabeth Denham summed up the grievance: millions of people's data was affected by Marriott's failure.

The US chapter: 344 million customers and a long order

On Oct. 9, 2024, the FTC announced a settlement: Marriott and subsidiary Starwood must implement a comprehensive information security program to resolve charges that lax data security led to three large breaches from 2014 to 2020 affecting more than 344 million customers worldwide. In a parallel settlement, Marriott agreed to pay $52 million to 49 states and the District of Columbia. The deal also gives US customers a way to request deletion of personal data tied to their email or loyalty account, and requires Marriott to restore stolen loyalty points on request. The FTC finalized the order on Dec. 20, 2024, adding a retention policy limited to what is reasonably necessary.

The FTC's complaint maps the internal failures: inadequate password, access and firewall controls, no network segmentation, unpatched outdated software, insufficient logging and monitoring, and deficient multifactor authentication. The FTC lacked authority to seek civil penalties in this case, which is why the states' $52 million penalty sits alongside the federal order.

What hospitality should take away

Start with where the risk lives. The 2014 intrusion sat inside the network of a company acquired two years later: a merger without deep security due diligence inherits a liability, and the FTC made Marriott responsible for the practices of both brands after 2016. Then consider the franchise model: the 2020 breach started with two employee credentials at a franchise property, not the core corporate network.

Finally, consider how long the data stays dangerous. Passport numbers and full guest identities do not just circulate on carding forums; they enable impersonation for years. The combined lesson of the two regulatory files is blunt: collect less data, segment and monitor the network, and treat the security of an acquired or franchised property as a day-one project, not a post-signature cleanup.