Data Breaches Lead to $52 Million Settlement for Marriott and a Lesson in Cybersecurity for Hospitality.
In a significant cybersecurity setback, Marriott International has agreed to pay a hefty fine and implement stricter data security measures to address important data breaches that affected hundreds of millions of customers worldwide.
The Federal Trade Commission (FTC) and a coalition of 49 state attorneys general and the District of Columbia launched investigations into three separate data breaches that occurred between 2014 and 2020. These breaches compromised the personal information of 300 million guests, including passport numbers, payment card details, and contact information.
In early 2020, Marriott noticed an unexpected amount of guest information was accessed using the login credentials of two employees at a franchised property. The company estimated that the personal data of about 5.2. million guests worldwide might have been affected.
In November 2018, Marriott announced a massive data breach in which hackers accessed information on up to 383 million guests. Marriott said unencrypted passport numbers for at least 5.25 million guests and credit card information for 8.6 million guests were accessed. The affected hotel brands were operated by Starwood before it was acquired by Marriott in 2016.
The FBI led the investigation of that data theft, and investigators suspected the hackers were working on behalf of the Chinese Ministry of State Security.
Marriott’s Lax Security Practices
The FTC alleged that Marriott and subsidiary Starwood Hotels & Resorts Worldwide’s inadequate data security practices, such as weak password controls and insufficient network monitoring, contributed to the breaches. The hotel giant has acknowledged the security lapses and has committed to implementing robust measures to prevent future incidents.
“Malicious actors” obtained passport information, payment card numbers, loyalty numbers, dates of birth, email addresses, and/or personal information from hundreds of millions of consumers.
In a statement on its website Wednesday, Bethesda, Md.-based Marriott noted that it made no admission of liability as part of its agreements with the FTC and states. It also said data privacy and information security enhancements have already been implemented.
Key Takeaways for Hospitality Businesses
This case is a stark reminder for hospitality businesses of the critical importance of prioritizing cybersecurity. Here are some key takeaways:
- Invest in Robust Security Measures: To protect guest data, implement strong password policies, network monitoring, and encryption.
- Regularly Update Software and Systems: Keep your technology up-to-date to address vulnerabilities and prevent unauthorized access.
- Train Staff on Cybersecurity Awareness: Educate employees about best practices for handling guest data and recognizing potential threats.
- Conduct Regular Security Audits: Assess your property’s security posture and identify areas for improvement.
- Respond Swiftly to Breaches: In the event of a data breach, act promptly to contain the damage, notify affected guests, and take corrective measures.
The Cost of Neglect
As part of its proposed settlement with the FTC, Marriott agreed to “implement a robust information-security program” and provide all its U.S. customers with a way to request that any personal information associated with their email address or loyalty rewards account number be deleted.
The Marriott settlement underscores the severe financial consequences of data breaches. In addition to fines, businesses can face reputational damage, lost customer trust, and operational disruptions.
Protecting Guests and Your Business
By prioritizing cybersecurity, hospitality businesses can safeguard guest data, maintain trust, and mitigate financial risks. Investing in robust security measures is a legal requirement and a sound business decision.
As Cybersecurity Awareness Month continues, let’s reaffirm our commitment to protecting guest data and building a more secure hospitality industry.
Do you have any industry knowledge, experience, or news you’d like to share? Why not send us your press releases, survey results, news, and articles? We will review them and may publish them on the IHS website. Just complete the contact form and get in touch.