Anatomy of a Breach

Anatomy of a Breach: Marriott — 500 Million Guest Records and a Breach That Started Four Years Before Discovery

> series: anatomy_of_a_breach —— part: 119 —— target: marriott_starwood —— records: 500,000,000 —— breach_duration: 4_years —— proposed_fine: £99,000,000<span class="cursor-blink">_</span>_

Hedgehog Security 30 November 2018 14 min read

500 million guests. Four years undetected. The breach came with the acquisition.

On 30 November 2018, Marriott International disclosed that unauthorised access to the Starwood guest reservation database had been ongoing since 2014 — two years before Marriott acquired Starwood Hotels and Resorts in September 2016. Approximately 500 million guest records were affected, including names, addresses, phone numbers, email addresses, dates of birth, and — for a significant subset — passport numbers and encrypted payment card information. It was the second-largest data breach ever disclosed (after Yahoo's three billion).

The breach had been active for approximately four years before a security tool flagged a suspicious database query on 8 September 2018. For two of those four years, the compromised system belonged to Marriott — meaning Marriott had acquired an actively compromised system and operated it for two years without detecting the intrusion. The ICO proposed a £99 million GDPR fine (later reduced to £18.4 million) — the second-largest GDPR fine proposed, after British Airways.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Marriott bought Starwood. The breach came free.

The Marriott breach is the definitive case study for M&A cyber due diligence. When Marriott acquired Starwood in 2016, it acquired an actively compromised reservation system — and either did not discover this during due diligence or did not remediate it after acquisition. The parallels with TalkTalk's Tiscali legacy systems (2015) and Nortel's decade-long compromise (2012) are direct: acquisitions bring inherited security debt, and that debt must be identified and remediated.

M&A Due Diligence Must Include Cyber
Marriott's failure to identify the active compromise during the Starwood acquisition is the strongest possible argument for mandatory cyber due diligence in M&A transactions. Our <a href="/penetration-testing">penetration testing</a> is regularly commissioned as part of M&A due diligence — assessing the target's security posture before the deal closes.
Passport Numbers Stolen
The Marriott breach was notable for the inclusion of passport numbers — identity documents that cannot be easily changed and that enable identity fraud at international borders. The theft of passport data elevated the breach from a standard credential compromise to a potential national security concern.
Four Years Undetected
The breach persisted from 2014 to 2018 — four years. During that time, 500 million guest records were accessible to the attackers. <a href="https://www.socinabox.co.uk">SOC in a Box</a> provides the continuous monitoring that detects database access anomalies — reducing dwell time from years to hours.
£99 Million Proposed → £18.4 Million Final
The ICO's initial £99 million proposed fine was reduced to £18.4 million — reflecting Marriott's cooperation, steps taken to mitigate harm, and COVID-19's impact on the hospitality industry. Even at £18.4 million, the fine demonstrated the ICO's willingness to impose significant GDPR penalties. <a href="/cyber-essentials">Cyber Essentials</a> demonstrates the appropriate measures that reduce regulatory risk.

When you acquire a company, you acquire its security posture — including its breaches.

The Marriott breach established that M&A transactions must include comprehensive cyber security due diligence — assessing not just the target's current security posture but whether it is currently under active compromise. For UK organisations involved in acquisitions, our penetration testing provides the assessment that identifies inherited security debt. Cyber Essentials certification of acquisition targets provides evidence of baseline security. SOC in a Box provides the monitoring that detects inherited compromises. And UK Cyber Defence provides the forensic investigation capability when an acquired system is found to be compromised.


Marriott bought a breach with its acquisition. What are you buying?

Our <a href="/penetration-testing">penetration testing</a> assesses acquisition targets. <a href="/cyber-essentials">Cyber Essentials</a> certifies baseline security. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects inherited compromises.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles