> series: anatomy_of_a_breach —— part: 119 —— target: marriott_starwood —— records: 500,000,000 —— breach_duration: 4_years —— proposed_fine: £99,000,000<span class="cursor-blink">_</span>_
On 30 November 2018, Marriott International disclosed that unauthorised access to the Starwood guest reservation database had been ongoing since 2014 — two years before Marriott acquired Starwood Hotels and Resorts in September 2016. Approximately 500 million guest records were affected, including names, addresses, phone numbers, email addresses, dates of birth, and — for a significant subset — passport numbers and encrypted payment card information. It was the second-largest data breach ever disclosed (after Yahoo's three billion).
The breach had been active for approximately four years before a security tool flagged a suspicious database query on 8 September 2018. For two of those four years, the compromised system belonged to Marriott — meaning Marriott had acquired an actively compromised system and operated it for two years without detecting the intrusion. The ICO proposed a £99 million GDPR fine (later reduced to £18.4 million) — the second-largest GDPR fine proposed, after British Airways.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Marriott breach is the definitive case study for M&A cyber due diligence. When Marriott acquired Starwood in 2016, it acquired an actively compromised reservation system — and either did not discover this during due diligence or did not remediate it after acquisition. The parallels with TalkTalk's Tiscali legacy systems (2015) and Nortel's decade-long compromise (2012) are direct: acquisitions bring inherited security debt, and that debt must be identified and remediated.
The Marriott breach established that M&A transactions must include comprehensive cyber security due diligence — assessing not just the target's current security posture but whether it is currently under active compromise. For UK organisations involved in acquisitions, our penetration testing provides the assessment that identifies inherited security debt. Cyber Essentials certification of acquisition targets provides evidence of baseline security. SOC in a Box provides the monitoring that detects inherited compromises. And UK Cyber Defence provides the forensic investigation capability when an acquired system is found to be compromised.
Our <a href="/penetration-testing">penetration testing</a> assesses acquisition targets. <a href="/cyber-essentials">Cyber Essentials</a> certifies baseline security. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects inherited compromises.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call