Marriott agrees to pay $52 million, beef up data security to resolve probes over data breaches
By ALEX VEIGA
Posted 10/9/24
Marriott International has agreed to pay $52 million and make changes to bolster its data security to resolve state and federal claims related to major data breaches that affected more than 300 …
You must be a member to read this story.
Join our family of readers for as little as $5 per month and support local, unbiased journalism.
Current print subscribers can create a free account by clicking here
Otherwise, follow the link below to join.
To Our Valued Readers –
Visitors to our website will be limited to five stories per month unless they opt to subscribe. The five stories do not include our exclusive content written by our journalists.
For $6.99, less than 20 cents a day, digital subscribers will receive unlimited access to YourValley.net, including exclusive content from our newsroom and access to our Daily Independent e-edition.
Our commitment to balanced, fair reporting and local coverage provides insight and perspective not found anywhere else.
Your financial commitment will help to preserve the kind of honest journalism produced by our reporters and editors. We trust you agree that independent journalism is an essential component of our democracy. Please click here to subscribe.
Need to set up your free e-Newspaper all-access account? click here.
Non-subscribers
Click here to see your options for becoming a subscriber.
Register to comment
Click here create a free account for posting comments.
Note that free accounts do not include access to premium content on this site.
I am anchor
Marriott agrees to pay $52 million, beef up data security to resolve probes over data breaches
FILE - A person walks past the San Francisco Marriott Union Square hotel on July 11, 2019, in San Francisco. (AP Photo/Jeff Chiu, File)
Posted
By ALEX VEIGA
Marriott International has agreed to pay $52 million and make changes to bolster its data security to resolve state and federal claims related to major data breaches that affected more than 300 million of its customers worldwide.
The Federal Trade Commission and a group of attorneys general from 49 states and the District of Columbia announced the terms of separate settlements with Marriott on Wednesday. The FTC and the states ran parallel investigations into three data breaches, which took place between 2014 and 2020.
As a result of the data breaches, “malicious actors” obtained the passport information, payment card numbers, loyalty numbers, dates of birth, email addresses and/or personal information from hundreds of millions of consumers, according to the FTC’s proposed complaint.
The FTC claimed that Marriott and subsidiary Starwood Hotels & Resorts Worldwide’s poor data security practices led to the breaches.
Specifically, the agency alleged that the hotel operator failed to secure its computer system with appropriate password controls, network monitoring or other practices to safeguard data.
As part of its proposed settlement with the FTC, Marriott agreed to “implement a robust information security program” and provide all of its U.S. customers with a way to request that any personal information associated with their email address or loyalty rewards account number be deleted.
Marriott also settled similar claims brought by the group of attorneys general. In addition to agreeing to strengthen its data security practices, the hotel operator also will pay $52 million penalty to be split by the states.
In a statement on its website Wednesday, Bethesda, Maryland-based Marriott noted that it made no admission of liability as part of its agreements with the FTC and states. It also said it has already put in place data privacy and information security enhancements.
In early 2020, Marriott noticed that an unexpected amount of guest information was accessed using login credentials of two employees at a franchised property. At the time, the company estimated that the personal data of about 5.2. million guests worldwide might have been affected.
In November 2018, Marriott announced a massive data breach in which hackers accessed information on as many as 383 million guests. In that case, Marriott said unencrypted passport numbers for at least 5.25 million guests were accessed, as well as credit card information for 8.6 million guests. The affected hotel brands were operated by Starwood before it was acquired by Marriott in 2016.
The FBI led the investigation of that data theft, and investigators suspected the hackers were working on behalf of the Chinese Ministry of State Security, the rough equivalent of the CIA.