Technology & SurveillanceConfirmed
Marriott Starwood data breach (2014-18 disclosed)
The Marriott Starwood breach exposed approximately 339 million guest records — including passport numbers, encrypted payment card details, and travel history — from a database that had been compromised since 2014. Marriott acquired Starwood Hotels in September 2016 without discovering the intrusion, which continued for more than two years post-acquisition. The breach was disclosed on 30 November 2018. US and UK intelligence attributed the attack to APT10, a hacking group linked to China's Ministry of State Security, based on tools and techniques. The UK's ICO issued an initial GDPR fine of £99.2 million in July 2019, subsequently reduced to £18.4 million in October 2020. Seven million UK records were affected.
15 sources4% confidencefully sourced