Marriott Data Breach: What Was Exposed and What to Do

A breach that began in 2014 went unnoticed until 2018, and it exposed passport numbers.

By Siddharth ShankarUpdated October 22, 2026

The Marriott case is about a company that bought a hotel group and inherited a breach it did not find for years. It matters because the data included travel documents and, in some cases, unencrypted passport numbers.

What happened

The FTC’s October 9, 2024 press release describes three breaches across Starwood and Marriott systems:

• Breach 1: Starwood, June 2014. Payment card data of more than 40,000 customers. It went undetected for 14 months.
• Breach 2: Starwood, around July 2014. It went undetected until September 2018.
• Breach 3: Marriott’s own network, from September 2018 to February 2020. It went undetected until February 2020.

Across the three, the FTC says more than 344 million customers worldwide were affected.

How many records and what data

The FTC says Breach 2 accessed 339 million Starwood guest records, including 5.25 million unencrypted passport numbers. Breach 3 accessed 5.2 million guest records, including data on 1.8 million Americans.

Security Affairs, reporting on the UK regulator’s decision, lists exposed data including names, mailing addresses, phone numbers, email addresses, passport numbers, dates of birth, genders and arrival and departure information, with payment card numbers and expiry dates encrypted. The UK regulator’s own count was nearly 327 million guests, a figure that differs from the FTC’s, which is common as investigations refine numbers.

The UK fine

The UK Information Commissioner’s Office announced a fine of £18.4 million in October 2020 for failing to keep customers’ personal data secure. Security Affairs reports that the proposed fine had been £99 million in July 2019, and that the reduction reflected Marriott’s mitigation efforts and the economic impact of Covid-19. The ICO said Marriott failed to put appropriate technical or organisational measures in place.

The FTC order

The FTC alleged that the companies did not deploy reasonable security, citing weak password, access, firewall and network segmentation controls, unpatched software, poor logging and monitoring, and insufficient multifactor authentication.

The proposed order requires:

• a comprehensive information security program, certified to the FTC annually for 20 years, with an independent assessment every two years,
• keeping personal information only as long as reasonably necessary,
• a link for customers to request deletion of personal information, tied to an email address or loyalty account number,
• a review of unauthorized loyalty account activity on request and restoration of stolen points,
• a ban on misrepresenting data practices.

The FTC also said a separate $52 million penalty was agreed with 49 states and the District of Columbia. The order was subject to public comment, so check the FTC’s site for its final status.

What to do if you stayed at a Starwood or Marriott hotel

1. Run the free email check to see whether your address appears in known breaches.
2. If a passport number was involved, contact the passport authority in your country if you are concerned, and be alert to travel-document scams.
3. Check your loyalty account for activity you do not recognise.
4. Treat unexpected emails about bookings with care. See how to tell a real notice from phishing.
5. Consider a credit freeze if you are in the US.

The lesson

Data you gave a hotel years ago can still be at risk if the company kept it. Our guide to old data breaches explains how to judge the risk.