Marriott fined £18.4m over data breach which ‘affected 339 million customers’

Hotel chain Marriott has been fined £18.4million after a data breach which is thought to have affected around 339 million customers.

The sum demanded was initially £99m in July last year but it was reduced by the Information Commissioner’s Office (ICO) because of the economic impact of the pandemic and steps taken by the firm to mitigate the effects of the incident.

Marriott International said it does not intend to appeal over the decision, but makes “no admission of liability in relation to the decision or the underlying allegations”.

A cyber attack, from an unknown source, affected the systems of the Starwood hotels group in 2014 but was not detected until 2018, two years after Starwood was acquired by Marriott.

Starwood hotels include Trump Turnberry in Ayrshire, London’s Park Lane Sheraton Grand, Westbury Mayfair and Le Meridien Piccadilly.

It is believed the personal data involved differed between individuals but may have included names, email addresses, phone numbers, unencrypted passport numbers, arrival/departure information, guests’ VIP status and loyalty programme membership number.

The exact number of people affected is unclear as there may have been multiple records for an individual guest, but around seven million records relate to people in the UK.

The ICO said its investigation found that there were failures by Marriott to put appropriate technical or organisational measures in place to protect the personal data being processed on its systems.

“Personal data is precious and businesses have to look after it,” said Information Commissioner Elizabeth Denham.

Also Check:  Three per cent of ambulance staff with no symptoms test positive for coronavirus

“Millions of people’s data was affected by Marriott’s failure; thousands contacted a helpline and others may have had to take action to protect their personal data because the company they trusted it with had not.

“When a business fails to look after customers’ data, the impact is not just a possible fine – what matters most is the public whose data they had a duty to protect.”

Because the incident happened before the UK left the EU, the ICO investigated on behalf of all EU authorities as lead supervisory authority under the GDPR (General Data Protection Regulation).

The data regulator said it acknowledges that Marriott acted promptly to contact customers and has since instigated a number of measures to improve the security of its systems.

“Marriott deeply regrets the incident,” the firm said in a statement.

“Marriott remains committed to the privacy and security of its guests’ information and continues to make significant investments in security measures for its systems, as the ICO recognises.

“The ICO also recognises the steps taken by Marriott following discovery of the incident to promptly inform and protect the interests of its guests.

“Marriott wants to reassure guests that the incident and the ICO’s decision involved only Starwood’s separate network, which is no longer in use.”