Marriott Starwood Data Breach (2014-18 Disclosed)

Introduction

On 30 November 2018, Marriott International disclosed that the guest reservation database of its Starwood Hotels subsidiary had been compromised — and that the intrusion had begun in 2014, two years before Marriott completed its acquisition of Starwood in September 2016. The exposed data included the records of up to 500 million guests as initially disclosed, later revised to approximately 339 million, covering passport numbers, encrypted payment card details, dates of birth, addresses, phone numbers, and travel history.

The breach is notable for three reasons: its scale, the duration of undetected access (at least four years), and the attribution of responsibility to a Chinese state-linked threat actor operating under the direction of the Ministry of State Security.

The Starwood Acquisition and Inherited Risk

Marriott agreed to acquire Starwood Hotels and Resorts Worldwide — operator of brands including Sheraton, Westin, W Hotels, St. Regis, and Le Méridien — in November 2015, completing the $13.6 billion acquisition in September 2016. The merged entity became the world's largest hotel company by number of rooms.

Due diligence during the acquisition process did not detect the intrusion already present in Starwood's reservation database. Critics and security researchers noted that cybersecurity due diligence in major acquisitions of this period was frequently inadequate relative to the depth of financial and operational scrutiny. Post-acquisition, Marriott did not promptly migrate Starwood's systems to its own infrastructure or conduct a thorough security assessment of the inherited database environment. The Starwood Reservation Database continued to operate as a separate system.

Discovery and the Scope of Exposure

The breach was discovered in September 2018 by Marriott's internal security tools, which flagged an attempt to access the Starwood guest reservation database. A forensic investigation determined that an unauthorised party had been present in the system since at least 2014 and had been exfiltrating data. The investigators found evidence that attackers had installed two pieces of malware — a Remote Access Trojan (RAT) and a tool used to copy and compress files for exfiltration.

The initial disclosure on 30 November 2018 placed the exposed records at up to 500 million. Subsequent forensic analysis revised the figure downward to approximately 339 million unique guest records. Of these, approximately 5.25 million unencrypted passport numbers and 20.3 million encrypted passport numbers were exposed; approximately 8.6 million encrypted payment card numbers were exposed, of which approximately 354,000 may still have been within expiry date at the time of disclosure.

Attribution: APT10 and Chinese State Intelligence

US and UK intelligence agencies, as well as independent security researchers, attributed the breach to APT10 — a threat actor also known as Stone Panda or MenuPass, assessed to be operating on behalf of China's Ministry of State Security (MSS). Reporting by the Washington Post and Reuters in late 2018, citing US officials, stated that intelligence agencies had concluded the attack was part of a broader Chinese intelligence-gathering operation targeting US citizens' travel, financial, and identification data.

The Chinese government denied involvement. The attribution was stated with confidence by US and UK officials but was not tested in a public legal proceeding in either jurisdiction.

UK GDPR Fine and Regulatory Response

Marriott notified the UK's Information Commissioner's Office within the 72-hour GDPR window. In July 2019, the ICO issued a Notice of Intent to fine Marriott £99.2 million under GDPR Article 83, citing failure to undertake sufficient due diligence in the Starwood acquisition and failure to implement adequate security measures. Seven million UK-resident records were among those exposed.

In October 2020, the ICO reduced the fine to £18.4 million, citing in part the economic impact of the COVID-19 pandemic on the hospitality sector and Marriott's cooperation with the investigation. The reduction was controversial; privacy advocates argued it undermined the deterrent effect of GDPR enforcement.

In the United States, the FTC investigated but did not impose a standalone fine. A class action settlement was reached separately; Marriott also faced regulatory scrutiny from multiple state attorneys general.

Verdict

Confirmed. The breach is documented through Marriott's own disclosures, ICO enforcement proceedings, congressional testimony, and forensic investigation records. The attribution to APT10 and Chinese MSS is assessed as credible by US and UK intelligence agencies. The failure of acquisition due diligence and post-acquisition security integration is confirmed by the ICO's findings.

The Record Count Kept Moving: 500 Million, Then 383 Million, Then 339 Million

One detail often flattened in retellings of this breach is that the headline number was never a single, stable figure. Marriott's initial 30 November 2018 disclosure said the Starwood database contained information on up to approximately 500 million guests. On 4 January 2019, Marriott issued an update revising that ceiling down to approximately 383 million — but the company was explicit that 383 million was an upper limit on the number of records, not a confirmed count of unique individuals, because many guests had multiple reservation records in the database. Marriott stated it believed the true number of unique guests affected was lower, but said it could not precisely quantify that smaller figure given the structure of the data. Later public reporting and regulatory summaries settled on approximately 339 million as the working figure for unique guest records, including roughly 5.25 million unencrypted passport numbers, 20.3 million encrypted passport numbers, and about 8.6 million encrypted payment card numbers (of which some 354,000 were still unexpired). Anyone citing a single fixed number for this breach is already simplifying a figure that shifted twice within two months of disclosure.

What "China Did It" Actually Rested On

The attribution to China's Ministry of State Security (MSS) is widely repeated, but it is worth being precise about what it was based on. In mid-December 2018, an unnamed US official briefed on the investigation told the Associated Press that investigators suspected hackers working for the MSS were responsible. FBI Assistant Director Bill Priestap, describing the broader pattern of Chinese intrusions being uncovered around the same period, told reporters: "Every rock we turn over, every time we looked for it, it's not only there, it's worse than we anticipated." That quote captured the mood of the investigation, but it was not a technical finding about Marriott specifically.

At the same time, independent cybersecurity researchers publicly pushed back on how solid the attribution was. Priscilla Moriuchi, then a threat-intelligence researcher at Recorded Future (and a former NSA analyst focused on East Asia), was quoted cautioning that "no one has put out any actual data or indicators showing Chinese state actor involvement in the Marriott intrusion." Reporting at the time also noted that the tools and techniques cited as evidence — while consistent with patterns seen in prior China-linked intrusions — were not unique to state actors and had in some cases been publicly available, meaning other actors could have used them too. Marriott itself, for its part, said at the time it had "no information about the cause of this incident" and had "not speculated about the identity of the attacker." None of this makes the China attribution false — US and UK intelligence agencies did converge on it, and it remains the dominant assessment — but the public evidentiary record supporting it is thinner than the confidence with which it is usually repeated.

The APT10 Indictment Didn't Name Marriott

It's a common point of confusion that the December 2018 US Department of Justice indictment of two Chinese nationals tied to APT10 (also referenced in the existing sources on this page) is sometimes read as "proof" the Marriott breach was legally established as Chinese state action. It wasn't. That indictment charged the defendants over the "Cloudhopper" campaign, which targeted managed service providers and their client networks — a related but legally distinct set of intrusions. No US or UK criminal charge, civil finding, or court judgment has ever named the Marriott/Starwood intrusion itself as a proven act of the Chinese state. The MSS attribution for Marriott specifically rests on intelligence-community assessment and officials' characterizations to journalists, not on a prosecuted case or a published forensic report naming Marriott.

A Second Reckoning: the FTC and 50-State Settlement of 2024

The regulatory story did not end with the ICO's 2020 fine. On 9 October 2024 — nearly six years after disclosure — the US Federal Trade Commission announced a settlement with Marriott and Starwood Hotels & Resorts Worldwide covering three separate data breaches spanning 2014 to 2020 that collectively compromised the personal data of more than 344 million consumers. The FTC itself imposed no monetary penalty, stating it lacked the statutory authority to seek one in this matter, but secured a 20-year consent order requiring biennial independent security assessments, annual risk assessments, a written information-security program built on data-minimization principles, vendor and franchisee oversight, security assessments during future acquisitions, and a route for US consumers to request deletion of their personal data and restoration of stolen loyalty points. Separately, on the same day, Marriott agreed to pay $52 million to settle with 49 state attorneys general and the District of Columbia, coordinated by Connecticut, Maryland, Oregon, Illinois, Louisiana, Massachusetts, North Carolina, Texas, and DC as co-leads. That settlement required Marriott to adopt zero-trust security architecture principles and enhanced employee training going forward. This is a materially different — and more consequential in dollar terms — regulatory outcome than the UK's £18.4 million ICO fine, and it postdates the original disclosure by six years, underscoring how long the legal tail of a breach of this scale runs.

2020: A Different Breach, Same Pattern

A detail frequently elided when people discuss "the Marriott breach" is that there was a second, entirely separate incident disclosed in 2020. On 31 March 2020, Marriott notified customers of unauthorized access to an application used by franchised and managed properties to service guests, which had compromised the records of approximately 5.2 million guests — contact details, loyalty account numbers, and personal preference data, though Marriott stated passwords, payment cards, and passport numbers were not involved. The intrusion is believed to have started around mid-January 2020, using the login credentials of two employees at a franchise property, and was discovered at the end of February 2020. This incident is legally and technically distinct from the 2014–2018 Starwood breach — different attack vector, different systems, no China attribution attached to it — but the FTC's 2024 settlement treats it as part of the same pattern of inadequate security oversight, particularly around franchisee and vendor access controls. Conflating the two breaches, or treating the 2020 incident as evidence of continued Starwood-era compromise, would be inaccurate; treating it as evidence Marriott's post-2018 security remediation was incomplete is what the regulators themselves concluded.

Delay Is Not the Same as Cover-Up

Because this page's verdict is "confirmed" — the breach indisputably happened and was disclosed — it's worth being precise about what remains genuinely disputed versus settled. The four-year gap between the 2014 intrusion and 2018 discovery is sometimes framed as suggesting Marriott (or Starwood before it) knew and sat on it. No regulatory finding — not the ICO's, not the FTC's — makes that claim. Both regulators' findings center on failure to detect and failure to adequately secure: inadequate due diligence during the 2016 acquisition, failure to encrypt or monitor the Starwood database sufficiently, and failure to migrate or fully audit inherited systems after the merger closed. That is a story of negligence and inadequate controls, not one of a documented decision to conceal a known breach. Marriott self-reported to the ICO within the GDPR's 72-hour window once it discovered the intrusion in September 2018, and disclosed publicly within roughly ten weeks of discovery. The distinction matters: "disclosed late because no one found it" and "disclosed late because it was hidden" carry very different implications, and the public record supports the former, not the latter.

What This Means for the Verdict

None of the above changes the verdict on this page. The breach happened, it was disclosed, the scale was enormous, and regulators on both sides of the Atlantic have now formally sanctioned Marriott over it — twice, six years apart. What the fuller record adds is calibration: the guest-record figure was a moving target rather than a single fixed number; the China attribution is a confident intelligence assessment repeated by officials and outlets, not a court-tested finding, and independent researchers have publicly noted the absence of published forensic proof; and the multi-year delay in detection reflects documented security and due-diligence failures rather than any established intent to conceal. A second, unrelated 2020 breach and a 2024 US regulatory settlement extend the story well past the original 2018 disclosure and show the security failures were not confined to the inherited Starwood system alone.