incident · 1536364800000

Marriott Starwood Data Breach

Marriott International disclosed a massive data breach involving its Starwood guest reservation database, exposing the personal information of hundreds of millions of guests.

What happened

Attackers gained unauthorized access to the Starwood network in 2014, before Marriott acquired the company in 2016. The breach went undetected until September 2018, allowing attackers to exfiltrate names, contact info, passport numbers, and encrypted payment cards.

Technical mechanism

Attackers compromised the network, escalated privileges, and deployed malware to access and exfiltrate data from the reservation database over a period of four years.

Why it matters

One of the largest data breaches in history, highlighting the cybersecurity risks associated with corporate acquisitions and legacy IT systems.

Impact

Exposed records for approximately 500 million guests (later revised down to ~383 million). Marriott faced significant regulatory fines, including from the UK ICO and the FTC, and numerous class-action lawsuits.

Response

Marriott phased out the Starwood systems, implemented enhanced security measures, offered identity protection services, and cooperated with law enforcement and regulators.

Defensive lessons

  • Thorough cybersecurity due diligence is critical during mergers and acquisitions.
  • Long-term network persistence by attackers requires advanced threat hunting and anomaly detection.
  • Encryption keys must be stored securely and separately from the encrypted data.

Evidence register

  1. Federal Trade Commission — FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches (verified)