Real-life caseOctober 2024
Marriott and Starwood, hospitality
In 2016, Marriott bought the hotel group Starwood. An intrusion into Starwood's reservation system, present since 2014, was only discovered in 2018. Up to 339 million guests were affected.
Marriott says it could only carry out a limited audit of Starwood's systems before the acquisition. The UK regulator pointed out that due diligence is not a one-off exercise, and fined Marriott 18.4 million pounds in 2020 (Mayer Brown (opens in a new tab)).
In October 2024, the FTC, the US consumer protection authority, required Marriott to run a security programme under oversight for 20 years. Marriott also paid 52 million dollars to 49 US states and the District of Columbia.
Read the sourceFTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches — Federal Trade Commission (opens in a new tab)