Marriott Starwood Data Breach (2014-18 Disclosed)
Introduction
On 30 November 2018, Marriott International disclosed that the guest reservation database of its Starwood Hotels subsidiary had been compromised — and that the intrusion had begun in 2014, two years before Marriott completed its acquisition of Starwood in September 2016. The exposed data included the records of up to 500 million guests as initially disclosed, later revised to approximately 339 million, covering passport numbers, encrypted payment card details, dates of birth, addresses, phone numbers, and travel history.
The breach is notable for three reasons: its scale, the duration of undetected access (at least four years), and the attribution of responsibility to a Chinese state-linked threat actor operating under the direction of the Ministry of State Security.
The Starwood Acquisition and Inherited Risk
Marriott agreed to acquire Starwood Hotels and Resorts Worldwide — operator of brands including Sheraton, Westin, W Hotels, St. Regis, and Le Méridien — in November 2015, completing the $13.6 billion acquisition in September 2016. The merged entity became the world's largest hotel company by number of rooms.
Due diligence during the acquisition process did not detect the intrusion already present in Starwood's reservation database. Critics and security researchers noted that cybersecurity due diligence in major acquisitions of this period was frequently inadequate relative to the depth of financial and operational scrutiny. Post-acquisition, Marriott did not promptly migrate Starwood's systems to its own infrastructure or conduct a thorough security assessment of the inherited database environment. The Starwood Reservation Database continued to operate as a separate system.
Discovery and the Scope of Exposure
The breach was discovered in September 2018 by Marriott's internal security tools, which flagged an attempt to access the Starwood guest reservation database. A forensic investigation determined that an unauthorised party had been present in the system since at least 2014 and had been exfiltrating data. The investigators found evidence that attackers had installed two pieces of malware — a Remote Access Trojan (RAT) and a tool used to copy and compress files for exfiltration.
The initial disclosure on 30 November 2018 placed the exposed records at up to 500 million. Subsequent forensic analysis revised the figure downward to approximately 339 million unique guest records. Of these, approximately 5.25 million unencrypted passport numbers and 20.3 million encrypted passport numbers were exposed; approximately 8.6 million encrypted payment card numbers were exposed, of which approximately 354,000 may still have been within expiry date at the time of disclosure.
Attribution: APT10 and Chinese State Intelligence
US and UK intelligence agencies, as well as independent security researchers, attributed the breach to APT10 — a threat actor also known as Stone Panda or MenuPass, assessed to be operating on behalf of China's Ministry of State Security (MSS). Reporting by the Washington Post and Reuters in late 2018, citing US officials, stated that intelligence agencies had concluded the attack was part of a broader Chinese intelligence-gathering operation targeting US citizens' travel, financial, and identification data.
The Chinese government denied involvement. The attribution was stated with confidence by US and UK officials but was not tested in a public legal proceeding in either jurisdiction.
UK GDPR Fine and Regulatory Response
Marriott notified the UK's Information Commissioner's Office within the 72-hour GDPR window. In July 2019, the ICO issued a Notice of Intent to fine Marriott £99.2 million under GDPR Article 83, citing failure to undertake sufficient due diligence in the Starwood acquisition and failure to implement adequate security measures. Seven million UK-resident records were among those exposed.
In October 2020, the ICO reduced the fine to £18.4 million, citing in part the economic impact of the COVID-19 pandemic on the hospitality sector and Marriott's cooperation with the investigation. The reduction was controversial; privacy advocates argued it undermined the deterrent effect of GDPR enforcement.
In the United States, the FTC investigated but did not impose a standalone fine. A class action settlement was reached separately; Marriott also faced regulatory scrutiny from multiple state attorneys general.
Verdict
Confirmed. The breach is documented through Marriott's own disclosures, ICO enforcement proceedings, congressional testimony, and forensic investigation records. The attribution to APT10 and Chinese MSS is assessed as credible by US and UK intelligence agencies. The failure of acquisition due diligence and post-acquisition security integration is confirmed by the ICO's findings.
Evidence Filters10
Intrusion began 2014 — two years before Marriott acquisition closed
SupportingStrongForensic investigation determined attackers had been present in Starwood's reservation database since at least 2014. Marriott completed the Starwood acquisition in September 2016. The intrusion persisted for over four years in total before discovery.
339M guest records exposed including passport numbers
SupportingStrongApproximately 339 million unique guest records were exposed, including approximately 5.25 million unencrypted passport numbers, 20.3 million encrypted passport numbers, encrypted payment card details, travel itineraries, and personal contact information.
APT10 / China MSS attribution per US and UK intelligence
SupportingStrongUS and UK intelligence agencies attributed the breach to APT10 (Stone Panda), a threat actor assessed to be operating under the direction of China's Ministry of State Security. The Washington Post and Reuters reported the attribution citing US officials. The Chinese government denied involvement.
Rebuttal
Intelligence attribution to a state actor has not been tested in a public legal proceeding in either the US or UK. China's denial is expected and not inherently exculpatory. The attribution is assessed as credible by independent security researchers based on tools, infrastructure, and tradecraft.
Acquisition due diligence did not detect the intrusion
SupportingStrongMarriott's $13.6 billion acquisition of Starwood in 2015-16 did not include cybersecurity due diligence sufficient to detect an ongoing intrusion. Critics and the ICO noted this as a systemic failure of corporate acquisition practice in the technology sector.
ICO GDPR fine £99.2M reduced to £18.4M
SupportingStrongThe UK's Information Commissioner's Office issued an initial fine of £99.2 million in July 2019 under GDPR Article 83. Following representations from Marriott — citing COVID-19's economic impact and the company's cooperation — the ICO reduced the fine to £18.4 million in October 2020.
Starwood systems not migrated or fully assessed post-acquisition
SupportingStrongAfter completing the Starwood acquisition, Marriott did not promptly migrate Starwood's reservation systems to its own infrastructure. The Starwood Reservation Database continued to operate as a separate legacy system, deferring the security review that would have been required in a migration.
GDPR fine reduction criticised by privacy advocates
NeutralPrivacy advocates and data protection specialists criticised the ICO's reduction of the fine from £99.2M to £18.4M, arguing it weakened the deterrent effect of GDPR enforcement and sent a poor signal about accountability for large-scale breaches involving acquisition due-diligence failures.
Rebuttal
The ICO cited COVID-19 economic hardship and Marriott's cooperation as grounds for the reduction. Critics argued these factors should not apply to a pre-COVID security failure. The fine reduction is a legitimate policy disagreement, not evidence that the breach itself did not occur.
Breach disclosed within 72-hour GDPR window
NeutralWeakMarriott notified the ICO within the 72-hour GDPR breach notification requirement. This compliance with notification rules was cited in the ICO's subsequent proceedings as a mitigating factor alongside Marriott's cooperation with the investigation.
Acquisition Due-Diligence Gap Was a Known M&A Risk, Not Deliberate Concealment
NeutralCyber-security due diligence in major corporate acquisitions was not standardized practice in 2015-2016 when Marriott acquired Starwood. The gap was a known industry problem — acquirers routinely inherited legacy security vulnerabilities without discovering them pre-close. Post-Marriott, M&A cybersecurity diligence became a standard practice area. This trajectory — problem identified, industry practice changes — is consistent with systemic learning, not with evidence that Marriott knew of the breach during acquisition and concealed it.
APT10 Attribution Reflects Industry-Wide Intelligence Consensus, Not Unverifiable Conspiracy Claim
DebunkingThe attribution of the Marriott Starwood breach to APT10 (Stone Panda), a Chinese state-sponsored threat actor, reflects consensus findings from Marriott's forensic investigators (FireEye/Mandiant), UK NCSC, and US IC community assessments. The UK ICO's finding of inadequate security — resulting in a fine — and the subsequent US DOJ indictment of APT10 members for related campaigns both occurred through transparent legal and regulatory processes. The breach's state-actor attribution is one of the more robustly documented in commercial cyber-espionage history.
Evidence Cited by Believers6
Intrusion began 2014 — two years before Marriott acquisition closed
SupportingStrongForensic investigation determined attackers had been present in Starwood's reservation database since at least 2014. Marriott completed the Starwood acquisition in September 2016. The intrusion persisted for over four years in total before discovery.
339M guest records exposed including passport numbers
SupportingStrongApproximately 339 million unique guest records were exposed, including approximately 5.25 million unencrypted passport numbers, 20.3 million encrypted passport numbers, encrypted payment card details, travel itineraries, and personal contact information.
APT10 / China MSS attribution per US and UK intelligence
SupportingStrongUS and UK intelligence agencies attributed the breach to APT10 (Stone Panda), a threat actor assessed to be operating under the direction of China's Ministry of State Security. The Washington Post and Reuters reported the attribution citing US officials. The Chinese government denied involvement.
Rebuttal
Intelligence attribution to a state actor has not been tested in a public legal proceeding in either the US or UK. China's denial is expected and not inherently exculpatory. The attribution is assessed as credible by independent security researchers based on tools, infrastructure, and tradecraft.
Acquisition due diligence did not detect the intrusion
SupportingStrongMarriott's $13.6 billion acquisition of Starwood in 2015-16 did not include cybersecurity due diligence sufficient to detect an ongoing intrusion. Critics and the ICO noted this as a systemic failure of corporate acquisition practice in the technology sector.
ICO GDPR fine £99.2M reduced to £18.4M
SupportingStrongThe UK's Information Commissioner's Office issued an initial fine of £99.2 million in July 2019 under GDPR Article 83. Following representations from Marriott — citing COVID-19's economic impact and the company's cooperation — the ICO reduced the fine to £18.4 million in October 2020.
Starwood systems not migrated or fully assessed post-acquisition
SupportingStrongAfter completing the Starwood acquisition, Marriott did not promptly migrate Starwood's reservation systems to its own infrastructure. The Starwood Reservation Database continued to operate as a separate legacy system, deferring the security review that would have been required in a migration.
Counter-Evidence1
APT10 Attribution Reflects Industry-Wide Intelligence Consensus, Not Unverifiable Conspiracy Claim
DebunkingThe attribution of the Marriott Starwood breach to APT10 (Stone Panda), a Chinese state-sponsored threat actor, reflects consensus findings from Marriott's forensic investigators (FireEye/Mandiant), UK NCSC, and US IC community assessments. The UK ICO's finding of inadequate security — resulting in a fine — and the subsequent US DOJ indictment of APT10 members for related campaigns both occurred through transparent legal and regulatory processes. The breach's state-actor attribution is one of the more robustly documented in commercial cyber-espionage history.
Neutral / Ambiguous3
GDPR fine reduction criticised by privacy advocates
NeutralPrivacy advocates and data protection specialists criticised the ICO's reduction of the fine from £99.2M to £18.4M, arguing it weakened the deterrent effect of GDPR enforcement and sent a poor signal about accountability for large-scale breaches involving acquisition due-diligence failures.
Rebuttal
The ICO cited COVID-19 economic hardship and Marriott's cooperation as grounds for the reduction. Critics argued these factors should not apply to a pre-COVID security failure. The fine reduction is a legitimate policy disagreement, not evidence that the breach itself did not occur.
Breach disclosed within 72-hour GDPR window
NeutralWeakMarriott notified the ICO within the 72-hour GDPR breach notification requirement. This compliance with notification rules was cited in the ICO's subsequent proceedings as a mitigating factor alongside Marriott's cooperation with the investigation.
Acquisition Due-Diligence Gap Was a Known M&A Risk, Not Deliberate Concealment
NeutralCyber-security due diligence in major corporate acquisitions was not standardized practice in 2015-2016 when Marriott acquired Starwood. The gap was a known industry problem — acquirers routinely inherited legacy security vulnerabilities without discovering them pre-close. Post-Marriott, M&A cybersecurity diligence became a standard practice area. This trajectory — problem identified, industry practice changes — is consistent with systemic learning, not with evidence that Marriott knew of the breach during acquisition and concealed it.
Timeline
Starwood reservation database first compromised
Forensic investigation later determines that attackers — attributed to APT10, assessed to operate under Chinese MSS direction — first gained access to the Starwood guest reservation database. The intrusion goes undetected. Exfiltration of passport numbers, payment cards, and travel history data begins.
Marriott acquisition of Starwood closes; intrusion not discovered
Marriott International completes its $13.6 billion acquisition of Starwood Hotels and Resorts, creating the world's largest hotel company. Due diligence does not detect the ongoing intrusion in the Starwood Reservation Database. The system continues to operate as a separate legacy environment post-acquisition.
Breach disclosed — 339M records exposed, intrusion since 2014
Marriott discloses the Starwood breach publicly on 30 November 2018, within the 72-hour GDPR window. Initial figure of up to 500 million records is later revised to approximately 339 million. US and UK intelligence attribute the attack to APT10 and Chinese MSS. The breach had persisted for over four years.
Source →ICO reduces GDPR fine to £18.4M citing COVID hardship
The UK ICO reduces its GDPR fine against Marriott from £99.2 million to £18.4 million, citing in part the economic impact of COVID-19 on the hospitality sector and Marriott's cooperation with the investigation. Privacy advocates criticise the reduction as undermining GDPR deterrence.
Source →
Verdict
Starwood reservation database compromised since 2014. Marriott acquired Starwood Sep 2016 without detecting the intrusion. Breach disclosed 30 Nov 2018. ~339M guest records exposed including passport numbers and payment cards. APT10 (China MSS) attribution per US and UK intelligence. ICO GDPR fine £99.2M Jul 2019 reduced to £18.4M Oct 2020. 7M UK records affected.
Frequently Asked Questions
How was a breach that began in 2014 undetected for four years?
The intrusion occurred in Starwood's reservation database prior to the Marriott acquisition. Due diligence during the acquisition did not include cybersecurity assessment sufficient to detect the ongoing intrusion. Post-acquisition, Marriott did not promptly migrate Starwood systems to its own infrastructure. The attacker used legitimate-looking remote access tools and staged data for exfiltration in ways designed to avoid triggering standard alerts.
Was the Marriott breach really carried out by China?
US and UK intelligence agencies attributed the breach to APT10, assessed to operate under China's Ministry of State Security direction, based on tools, infrastructure, and tradecraft analysis. Independent security researchers concurred. The DOJ indicted two APT10 members in December 2018. China denied involvement. The attribution has not been tested in a public legal proceeding but is considered credible by the intelligence and security research community.
Why was the GDPR fine reduced so significantly?
The ICO reduced the fine from £99.2M to £18.4M citing the economic impact of COVID-19 on the hospitality sector and Marriott's cooperation with the investigation. Privacy advocates criticised the reduction, arguing it undermined GDPR deterrence and rewarded cooperation in a way that was disproportionate to the scale of the breach and the due-diligence failure during the acquisition.
What data was exposed and why was passport data particularly sensitive?
Sources
Show 3 more sources
Further Reading
- paperAPT10 indictment — DOJ press release — US Department of Justice (2018)
- bookSandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers — Andy Greenberg (2019)
- paperICO Marriott International enforcement notice — full decision — Information Commissioner's Office (2020)