Skip to main content

Marriott faces $123M fine for huge data breach that targeted millions of guests

Marriott International is facing a fine of 99 million British pounds (about $123 million) for a data breach discovered in 2018 that affected around 339 million of its Starwood guests.

The hefty financial penalty has been proposed by the United Kingdom’s Information Commissioner’s Office (ICO) and comes a day after the same body hit British Airways with a record $230 million fine for a data breach suffered by the carrier last year.

The large size of the fines has much to do with new powers linked to the E.U.’s General Data Protection Regulation (GDPR) that came into force in 2018. It means that businesses can be fined up to 20 million euros (about $22.4 million) or up to 4% of the company’s annual global turnover, whichever is greater. In this case, the fine represents about 3% of Marriott’s 2018 revenue.

The data breach targeted a guest reservation system operated by Starwood, a hotel and leisure company that Marriott acquired in 2016. It’s believed to have started in 2014, but was only discovered last year.

Hackers were able to steal a huge variety of personal data from guests, including a combination of names, addresses, birth dates, phone numbers, email addresses, passport numbers, Starwood Preferred Guest account information, arrival and departure information, reservation dates, and encrypted payment card numbers.

It’s estimated that around 339 million guests globally were caught up in the breach, with 30 million of them living in the E.U.

A report issued by the ICO on Tuesday, July 9, said Marriott had failed to undertake sufficient due diligence when it acquired Starwood, adding that the hotel giant should have done more to secure its systems.

“The GDPR makes it clear that organizations must be accountable for the personal data they hold,” Information Commissioner Elizabeth Denham commented. “Personal data has a real value, so organizations have a legal duty to ensure its security, just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”

Responding to the proposed fine, Marriott International’s president, Arne Sorenson, said: “We are disappointed with this notice of intent from the ICO, which we will contest. Marriott has been cooperating with the ICO throughout its investigation into the incident, which involved a criminal attack against the Starwood guest reservation database.”

Sorenson added: ”We deeply regret this incident happened. We take the privacy and security of guest information very seriously and continue to work hard to meet the standard of excellence that our guests expect from Marriott.”

The move toward stiffer financial penalties for data breaches will be of major concern to businesses both big and small, though if the higher fines prompt companies to review their cyber defenses and make improvements where necessary, then customers everywhere will benefit.

Editors' Recommendations

Trevor Mogg
Contributing Editor
Not so many moons ago, Trevor moved from one tea-loving island nation that drives on the left (Britain) to another (Japan)…
How to find a Wi-Fi password on Mac
Man in front of iMac.

Forgotten your Wi-Fi password? We've all been there, but you can find your Wi-Fi password on your Mac if you have it to hand. You can just reset your Wi-Fi password if you want, but if you'd rather just take a look at it, here's how to recover your Wi-Fi password in macOS in a few quick steps.

Read more
How to factory reset Windows 10 or Windows 11
Windows 10 Home vs. Pro

Factory resetting Windows 10 or Windows 11 can be a great way to fix a sluggish or unresponsive computer. It clears our a lot of changes you might have made, applications that might be causing trouble, and old drivers that might not have been uninstalled properly. A fresh start can make your PC feel even better than general Windows speed up tricks.

Here's how to factory reset Windows 10 and Windows 11 to get your PC feeling right again.

Read more
How to cancel your ChatGPT Plus subscription
Infinix Zero 30 5G Android phone in gold color with ChatGPT virtual assistant.

ChatGPT-4 is one of the most powerful AI chatbots to ever hit our computers, smartphones, and tablets. Even though this version of OpenAI’s calling card platform is locked behind a $20 per month paywall, ChatGPT Plus subscribers receive a nice slew of extra features that are exclusive to paying account holders.

Read more