Marriott smacked with $33.7m fine over infamous data breach

The United Kingdom’s data privacy watchdog has fined Marriott International £18.4 million (around $33.7 million) for a major data breach that may have affected as many as 339 million guests.

The Information Commissioner’s Office (ICO) said the data obtained by hackers could have included names, email addresses, phone numbers, unencrypted passport numbers, arrival or departure information, and guests’ VIP status and loyalty program membership numbers.

The ICO’s investigation found that there were failures by Marriott to put appropriate safeguards in place, as required by the General Data Protection Regulation (GDPR), but acknowledged that the company had improved.

The precise number of people affected is unclear, but Marriott estimates 339 million guest records worldwide were affected following the cyber-attack in 2014 on Starwood Hotels and Resorts Worldwide Inc.

The attack, from an unknown source, remained undetected until September 2018, by which time the company had been acquired by Marriott.

However, the ICO said there may have been multiple records for an individual guest. Seven million guest records related to people in the UK.

“Personal data is precious and businesses have to look after it,” ICO information commissioner Elizabeth Denham said in a statement.

“Millions of people’s data was affected by Marriott’s failure; thousands contacted a helpline and others may have had to take action to protect their personal data because the company they trusted it with had not.

“When a business fails to look after customers’ data, the impact is not just a possible fine. What matters most is the public whose data they had a duty to protect.”

The ICO acknowledged that Marriott acted promptly to contact customers and the ICO. It also acted quickly to mitigate the risk of damage suffered by customers, the ICO said, and has since instigated several measures to improve the security of its systems.

Marriott International said it does not intend to appeal the decision, but made no admission of liability in relation to the decision or the underlying allegations.

The company added that it “deeply regrets” the incident.

“Marriott remains committed to the privacy and security of its guests’ information and continues to make significant investments in security measures for its systems, as the ICO recognises,” the company said in a statement.

“The ICO also recognises the steps taken by Marriott following discovery of the incident to promptly inform and protect the interests of its guests. Marriott wants to reassure guests that the incident and the ICO’s decision involved only Starwood’s separate network, which is no longer in use.”

Featured image source: iStock/volkan.basar