What is Marriott Data Breach?
A series of data breaches at Marriott International, the largest exposing 500 million Starwood guest records in 2018 — including passport numbers, credit cards, and travel histories — with attackers having undetected access for four years.
Also known as: Marriott Hack, Starwood Breach, Marriott Hotel Data Breach
Marriott's breach exposed the travel records and personal data of 500 million hotel guests — and the attackers had been inside the system for four years before anyone noticed.
Timeline
- 2014: Hackers breached Starwood Hotels' reservation database
- 2016: Marriott acquired Starwood for $13.6 billion — inheriting the breach unknowingly
- September 2018: Marriott detected the breach during a security review
- November 2018: Public disclosure — 500 million guests affected
- 2020: A second breach exposed 5.2 million additional guest records
- 2022: A third breach via social engineering compromised 20 GB of data
What Was Exposed (2018 Breach)
- 383 million guest records (names, addresses, phone numbers, email)
- 25.5 million passport numbers (5.25 million unencrypted)
- 8.6 million encrypted credit card numbers
- Arrival and departure dates
- Starwood Preferred Guest account information
- Travel patterns and booking history
Why Travel Data Matters
Movement Tracking
Four years of hotel reservations reveal detailed travel patterns — where someone goes, how often, who they travel with, and their routines.
Intelligence Value
Passport numbers, travel histories, and hotel stays are extremely valuable for intelligence agencies. The breach was attributed to Chinese intelligence.
Ongoing Vulnerability
With three separate breaches (2018, 2020, 2022), Marriott demonstrated a pattern of inadequate security — suggesting the company prioritizes convenience over guest privacy.
Regulatory Response
- UK ICO: Fined Marriott £18.4 million under GDPR (reduced from initial £99 million)
- FTC Settlement (2024): Required comprehensive security program and data minimization
- Multiple class action lawsuits
Related Terms
Data Breach
A security incident where protected, sensitive, or confidential data is accessed, stolen, or exposed by unauthorized individuals. Data breaches can result from hacking, insider threats, lost devices, or misconfigured systems.
Encryption at Rest
Encryption applied to data stored on disks, databases, or other storage media. When data is 'at rest' (not actively being transmitted), encryption protects it from unauthorized access if storage devices are stolen or compromised.
Identity Theft
The fraudulent use of someone's personal information — such as Social Security number, credit card details, or login credentials — to commit crimes or financial fraud.
PII (Personally Identifiable Information)
Any data that can be used to identify a specific individual, including name, address, phone number, email, Social Security number, and biometric data.
Have more questions?
Use our guided flow to get the right next privacy step for Marriott Data Breach.
Open Guided Flow