Marriott System Breach Undetected for 4 Years (2014 to 2018)

December 26, 2022


The first part of the cyber-attack happened in 2014, affecting the Starwood Hotels group, which was acquired by Marriott two years later. But until 2018, when the problem was first noticed, the attacker continued to have access to all affected systems. On that basis, the ICO said Marriott had failed to protect personal data as required by the General Data Protection Regulation (GDPR)

Information Commissioner's Office (ICO) dined Marriott hotel 18.4 Million pounds for the data breach.

Incident Date

May 31, 2014

Estimated Cost

estimated 339 million personal records compromised


Type of Malware

No Malware identified

Threat Source

No threat source identified