Oct. 29, 2026, 12:44 a.m.

Marriott Data Breach: How Were 500 Million Guests' Passport Details Stolen?

The Marriott International data breach incident that made global headlines in 2018 went down in history as one of the largest and most complex cybersecurity events ever recorded. The incident is critically important not only in terms of the number of people affected, but also due to the sophisticated nature of the attack and the important lessons it contains regarding the cybersecurity risks of corporate mergers. Personal data of more than 500 million hotel guests remained accessible to attackers for a full four years, during which sensitive information such as passport numbers, contact details, payment card information, and travel histories were compromised.

This case starkly demonstrated how critical cybersecurity assessments are, particularly during corporate merger and acquisition (M&A) processes. The system infrastructure that Marriott inherited when it acquired Starwood Hotels & Resorts in 2016 had actually been compromised much earlier and had backdoors planted within it. This situation revealed that corporate growth in the digital transformation age requires not only financial scrutiny but also deep cybersecurity examination.

Anatomy of the Attack: APT40 and State-Sponsored Cyber Espionage

Behind the Marriott data breach is a cyber espionage group known as APT40 (Advanced Persistent Threat 40), believed to be linked to the Chinese government. Unlike traditional cybercriminals, APT groups are state-sponsored, highly organized threat actors focused on long-term objectives. The goal of these groups is typically not financial gain, but intelligence gathering and access to strategic information.

APT40's infiltration operation into Starwood systems dates back to at least 2014. The attackers planted advanced backdoor mechanisms to maintain persistent access to the systems. These backdoors were designed so sophisticatedly that they could remain hidden from system updates, security patches, and even routine security scans. To increase their chances of remaining undetected, the attackers adopted a slow and methodical approach; this technique is called "low and slow" and is one of the most characteristic features of APT groups.

Critical Vulnerabilities in Starwood Systems

Starwood's reservation system, guest rewards program, and customer relationship management platforms were among the attackers' primary targets. These systems contained the most sensitive information of millions of customers:

• Passport numbers and identification information: Identity verification details of internationally traveling guests
• Contact information: Email addresses, phone numbers, and physical addresses
• Travel history: Accommodation dates, destinations, and travel habits
• Payment card information: Although encrypted, some credit card numbers and expiration dates
• Rewards program information: Starwood Preferred Guest (SPG) account details and loyalty points

The attackers' primary purpose in collecting this data was most likely to create valuable profiles for intelligence operations. Information about which individuals traveled to which countries, when, whom they met with, and where they stayed is invaluable for state-level intelligence work.

Cybersecurity Risk in Mergers and Acquisitions

The Marriott case painfully taught how critical cybersecurity assessment is in corporate acquisitions. When Marriott acquired Starwood for $13.6 billion in 2016, it inherited not just hotel chains and brands, but also a cyber threat that had been lurking inside for years. This situation emphasizes the importance of the concept of "cyber due diligence" in M&A processes.

Cybersecurity Checklist for M&A Processes

Critical elements to consider when conducting cybersecurity assessments in corporate acquisitions include:

• Comprehensive security audit: Detailed examination of all digital assets, network infrastructure, and security controls of the target company
• Historical breach and incident records: Previously experienced security incidents, data leaks, and unresolved security vulnerabilities
• Third-party risk assessment: Security status of suppliers, business partners, and external service providers
• Compliance status: Level of compliance with GDPR, data protection laws, and sectoral regulations
• Security culture analysis: Employee cybersecurity awareness and effectiveness of internal security policies

In Marriott's case, the existing APT40 presence in Starwood's systems was not detected during the pre-acquisition cybersecurity assessment. This raised important questions about both the depth of the assessment and APT groups' ability to remain undetected.

$124 Million GDPR Penalty and Legal Consequences

Following the disclosure of the Marriott data breach, the UK Information Commissioner's Office (ICO) initially proposed a GDPR fine of £99 million (approximately $124 million) for the company. This was one of the highest penalties issued under the European General Data Protection Regulation (GDPR). However, following subsequent assessments and considering the economic impacts of the COVID-19 pandemic, this penalty was reduced to £18.4 million (approximately $23 million).

GDPR and Data Protection Responsibilities

The Marriott case highlighted critical principles of GDPR:

• Accountability: Organizations must demonstrate that they have implemented appropriate technical and organizational measures to protect personal data
• Notification obligation: Data breaches must be reported to relevant regulatory authorities within 72 hours of detection
• Data minimization: Only necessary personal data should be collected and processed