2018
When Marriott International announced in November 2018 that its Starwood guest reservation database had been compromised—exposing up to 500 million guest records including passport numbers, credit card information, and travel patterns—it was simultaneously a cybersecurity crisis and a GDPR compliance crisis. The breach had begun in 2014, four years before Marriott acquired Starwood, which meant Marriott inherited both the compromised infrastructure and the attendant liability. The $123 million ICO fine that followed was one of the largest GDPR enforcement actions of the early years.
The Marriott breach is a foundational case study in M&A cybersecurity due diligence, long-dwell-time intrusion detection, and the compounding liability of acquiring companies without assessing their security posture. In an era of frequent corporate transactions, the Marriott example is the clearest evidence that cybersecurity due diligence is not optional in M&A—it is existential risk management.
The Starwood Breach: Origins and Timeline
The Starwood Hotels & Resorts guest database breach began in 2014—years before Marriott's $13.6 billion acquisition of Starwood in September 2016. Attackers had installed a Remote Access Trojan (RAT) in the Starwood network and maintained access undetected for years, systematically exfiltrating guest records. The attackers are widely attributed to a state-sponsored Chinese intelligence operation, with the stolen passport and travel data consistent with intelligence collection rather than pure financial crime.
Marriott completed the Starwood acquisition in 2016 without discovering the ongoing compromise. Standard cybersecurity due diligence in M&A transactions of this era focused primarily on known vulnerabilities, compliance status, and documented security programs—not on active threat hunting for undiscovered intrusions that could have been present for years. The acquisition process didn't include the type of forensic investigation that would have detected the long-running access.
The breach was finally discovered in September 2018—four years after initial compromise—when a security tool flagged an anomalous query to the Starwood guest database. Investigation confirmed the long-running unauthorized access and the scope of data exfiltration. The mandatory GDPR breach notification timeline compressed Marriott's response: the 72-hour notification requirement for GDPR-regulated data meant that once Marriott discovered the breach, rapid public disclosure was legally required.
The Regulatory Response: GDPR's First Major Hotel Industry Action
The UK Information Commissioner's Office led the GDPR regulatory response, ultimately issuing a £18.4 million (reduced from an initial £99 million) fine in 2020. The reduction from the initial amount reflected Marriott's post-discovery response: rapid notification, transparent disclosure, and substantial remediation investment were credited as mitigating factors.
The regulatory findings were instructive for the hospitality industry and M&A practitioners. The ICO determined that Marriott had failed to undertake adequate due diligence when it purchased Starwood, that it should have done more to secure its systems, and that it should have started rolling out a program to monitor accounts with access to the Starwood database. The regulatory standard applied was not 'had Marriott caused the breach' but 'had Marriott taken appropriate steps to prevent and detect it.'
Immediate Impact: M&A Cybersecurity Due Diligence Transforms
The Marriott case changed M&A cybersecurity practice across industries:
- Technical due diligence scope expanded: M&A cybersecurity assessments increasingly included active threat hunting and network forensics, not just documentation review
- Representations and warranties insurance for cyber risk became standard in large M&A transactions
- Data isolation periods post-close became common: acquirers maintaining acquired infrastructure in isolated network segments while conducting security assessments before full integration
- Hospitality industry security investment accelerated: hotels recognized that their guest databases—with payment, passport, and travel pattern data—were high-value targets requiring enterprise-grade protection
- GDPR awareness in M&A due diligence became mandatory: legal and compliance teams assessed GDPR exposure as a standard component of acquisition diligence
Lessons Learned: Long-Dwell-Time Attacks Require Behavioral Detection
The Marriott breach's four-year dwell time was not exceptional for sophisticated state-sponsored attacks—it was consistent with patterns seen in other major intrusions. The Verizon DBIR consistently showed median dwell times of months for targeted intrusions. Signature-based detection systems—antivirus, IDS/IPS configured for known attack patterns—are ineffective against patient, sophisticated attackers who avoid triggering known signatures.
Behavioral analytics, anomaly detection, and continuous network monitoring are the detection approaches that catch long-dwell-time attacks. The Marriott breach was discovered by an anomalous database query—behavior-based detection, not signature detection. Organizations that invest in behavioral analytics alongside signature-based controls significantly improve their detection capability for sophisticated intrusions.
The acquisition integration context is particularly important: newly acquired infrastructure should be treated as potentially compromised until demonstrated otherwise. Network isolation, enhanced monitoring, and accelerated security assessment of acquired systems are the appropriate response to M&A integration—not the assumption that acquired infrastructure is as secure as the due diligence documentation suggests.
Evolution: Data Protection in Hospitality and Retail
The Marriott breach and subsequent enforcement actions have driven hospitality industry security maturity. Guest database protection has received substantially increased investment; network segmentation between guest, operational, and reservation system networks is now standard practice at major hotel chains. Payment card data handling has been tightened by continued PCI-DSS enforcement.
The broader lesson—that large aggregated datasets of personal information are high-value attack targets—has been reinforced by subsequent breaches across industries. Organizations that maintain large customer databases containing identification documents, financial data, and behavioral information face elevated threat levels and need to invest in protection commensurate with the data's value to adversaries.
The Outpace Approach: Data Protection Assessment
Outpace Professional Services conducts data protection assessments for organizations holding sensitive customer data—evaluating the security controls protecting high-value data assets, assessing detection capabilities for long-dwell-time intrusions, and identifying gaps between current protection and the threat level the data attracts.
For clients undertaking M&A transactions, we design cybersecurity due diligence programs that include active threat hunting in acquired infrastructure—going beyond documentation review to detect active compromises that standard due diligence processes miss. The Marriott lesson is clear: the cost of proper M&A cyber diligence is orders of magnitude less than the cost of inheriting an active breach.
The Continuing Relevance
Data breaches involving large customer databases have continued to occur at scale after Marriott. Each major breach repeats the Marriott lesson in a new sector: attackers target data aggregation points; long-dwell-time attacks require behavioral detection; M&A integration creates breach inheritance risk. Organizations that internalize these lessons invest appropriately; those that don't are learning the hard and expensive way.
💡 Ready for a data protection assessment? Outpace Professional Services evaluates the security controls protecting your most sensitive data assets, assesses behavioral detection capabilities for long-dwell-time threats, and identifies the gaps that expose your organization to Marriott-scale breach liability.
