The United Kingdom’s (UK’s) privacy watchdog has fined the Marriott Hotels chain £18.4m for a hack that compromised the data of more than 339 million guests.
The Information Commissioner’s Office (ICO) said names, contact information, and passport details may all have been compromised in a cyber-attack.
The breach included seven million guest records for people in the UK. The ICO said the company failed to put appropriate safeguards in place.
The first part of the cyber-attack happened in 2014, affecting the Starwood Hotels group, which was acquired by Marriott two years later. But until 2018, when the problem was first noticed, the attacker continued to have access to all affected systems, including:
Names
Email addresses
Phone numbers
Passport numbers
Arrival and departure information
VIP status
loyalty program numbers
On that basis, the ICO said Marriott had failed to protect personal data as required by the General Data Protection Regulation (GDPR).
“The cyber-criminals had been in the systems for years and were effectively thrown into the merger deal without Marriott having a clue. Herein lies the issue, though – it seems that the hotel didn’t check what it was buying,” said cyber reporter, Joe Tidy.
The ICO report makes clear Marriott beefed up the security of Starwood’s IT systems far too late and the hackers had free rein to move around, cherry-picking the data that would sell best on criminal forums.
The fine is nothing like the £99m the ICO planned to issue, but it’s still a massive deterrent for future companies. It may make executives planning their next big mergers look more carefully and cautiously at the databases they’re about to acquire.
