Marriott's Starwood breach exposed 500M guests' data — and it went undetected for 4 years

In November 2018, Marriott International disclosed that hackers had accessed the guest reservation database of its Starwood Hotels division, compromising approximately 500 million guest records. The breach had begun in 2014 — before Marriott acquired Starwood in 2016 — and went undetected for approximately four years.

The stolen data included names, addresses, phone numbers, email addresses, passport numbers, and in some cases, encrypted credit card numbers and travel itineraries. The breach was one of the largest in hospitality history and raised concerns about state-sponsored espionage, as the data could be used for intelligence purposes.

Marriott was fined £99 million by the UK's Information Commissioner's Office (later reduced to £18.4 million) for failing to protect customer data. The case illustrated how an acquisition can inherit a security breach along with the assets, and how a breach that goes undetected for years can span multiple ownerships without either company discovering it.