Marriott International — £18.4M GDPR fine (2020)

Starwood acquisition inherited a 4-year undetected breach — 339M records

What happened

When Marriott acquired Starwood in 2016, it inherited a guest-reservation database that had been compromised since 2014. The breach was not detected until 2018, exposing 339M guest records (passport numbers, payment cards, contact info). ICO's penalty was reduced from a proposed £99M to £18.4M.

Root cause

• Acquisition diligence did not include a security assessment of Starwood systems
• No post-acquisition migration off legacy reservation DB
• Insufficient monitoring let attackers persist 4 years

What every team should do

1. Make a security + privacy assessment a mandatory closing condition for M&A
2. Plan post-close re-platforming with a hard sunset date for inherited systems
3. Run threat-hunting + SIEM coverage extension on day 1 post-close

Related enforcement actions