The 2018 Marriott data breach exposed on up to 500 million guests through the Starwood reservation system, which had been compromised since around 2014 and went undetected for roughly four years. It exposed names, passport numbers, travel details and some payment data, and it shows how an unnoticed intrusion can quietly collect data for years.
The Marriott data breach is one of the clearest examples of why the length of time an attacker remains undetected can matter as much as the initial point of compromise.
In November 2018, Marriott International announced that attackers had gained unauthorised access to the Starwood guest reservation database. The company initially estimated that information relating to up to 500 million guests could have been involved.
The investigation later reduced the estimate. In January 2019, Marriott said the upper limit was approximately 383 million guest records, although it could not establish how many unique individuals were represented because some guests had multiple records.
The scale was significant, but the most important detail was the timeline.
The attackers had been inside Starwood’s environment since 2014.
Marriott acquired Starwood in 2016.
The intrusion was not discovered until September 2018.
That means the compromise continued for roughly four years, including approximately two years after Marriott acquired Starwood. The incident demonstrates why organisations need to understand not only what is exposed today, but how long attackers can remain undetected when monitoring and security controls fail.
What Happened and When
The incident began in Starwood’s environment before Marriott acquired the company.
According to the US Federal Trade Commission, forensic examiners determined that malicious actors compromised a Starwood external-facing web server around July 28, 2014. Malware was installed and used for network reconnaissance, credential harvesting and movement through the internal network.
The attackers remained undetected as they moved through Starwood’s systems.
Marriott announced its acquisition of Starwood in 2016, and the acquisition was completed later that year. The attackers were already present in the Starwood environment when Marriott took ownership.
Marriott eventually received an alert on September 8, 2018 relating to an attempt to access the Starwood guest reservation database. The company’s investigation determined that unauthorised access to the Starwood network had existed since 2014.
On November 30, 2018, Marriott publicly disclosed the incident.
The timeline is important because this was not a short intrusion followed by immediate detection. The attackers had years to operate inside the environment.
Why the Four-Year Dwell Time Matters
A data breach becomes more damaging when attackers have time to explore an environment.
A short-lived intrusion may expose one system or a limited amount of information.
A long-running compromise gives attackers more opportunities to identify valuable systems, obtain credentials, move between networks and access databases.
The FTC’s later investigation found that malicious actors had installed keyloggers, memory-scraping malware and remote access tools across more than 480 systems at 58 locations within the Starwood environment during the period of compromise.
The attackers were therefore not simply sitting inside one database.
They had established a presence across the wider environment.
This is the core lesson from Marriott.
Time is an attacker advantage.
The longer an organisation takes to discover an intrusion, the more opportunities an attacker has to expand the impact.
This is why detection cannot be treated as a final stage after prevention. Organisations need controls that identify suspicious activity and exposed information as early as possible.
What Data Was Exposed?
The Starwood reservation database contained significant amounts of personal and travel information.
According to the US Federal Trade Commission, compromised information included names, gender, dates of birth, payment card information, addresses, email addresses, telephone numbers, usernames, Starwood loyalty numbers, partner loyalty programme numbers and information about hotel stays. This included locations, duration of stays and information about guests.
Passport information was also involved.
The FTC later stated that approximately 5.25 million unencrypted passport numbers were among the compromised Starwood records.
Some payment card information was also exposed.
The exact information varied from guest to guest, which is common in large database breaches. Not every affected record necessarily contained every type of information.
The important point is that the database combined multiple categories of information.
A name by itself may not provide much value to an attacker.
A name combined with an email address, travel history, loyalty account information and passport details creates a much more useful identity profile.
That information can support fraud, impersonation, phishing and targeted social engineering.
The Role of the Starwood Acquisition
One of the most important aspects of the Marriott incident is that the compromised environment belonged to an acquired company.
Marriott acquired Starwood in 2016 while the attackers were already inside Starwood’s systems.
The FTC later alleged that Marriott and Starwood failed to implement reasonable security practices, including appropriate password controls, access controls, firewall controls, network segmentation, software patching, logging, monitoring and multifactor authentication.
The FTC’s complaint also states that Marriott did not identify the ongoing Starwood breach until September 2018, nearly two years after the legal close of the acquisition.
This highlights a major cybersecurity issue during mergers and acquisitions.
When one company acquires another, it does not simply acquire employees, customers and technology.
It also inherits security risks.
An organisation can have strong security controls across its own environment while still carrying vulnerabilities, compromised accounts, outdated systems or hidden attacker access inherited from an acquisition.
That makes cybersecurity due diligence an important part of M&A activity.
Why Long Undetected Access Is So Damaging
Attackers benefit from time.
With enough time, they can learn how the organisation works.
They can identify administrators.
They can locate sensitive databases.
They can collect credentials.
They can move between systems.
They can identify valuable information.
They can also return to systems after an initial defensive response if persistence has not been fully removed.
The Marriott incident demonstrates this clearly.
The FTC’s investigation found that attackers harvested highly privileged Starwood administrative and user credentials and used those credentials to move through the internal network.
This is why dwell time is such an important security metric.
An organisation may have strong perimeter controls and still suffer serious damage if an attacker can remain inside for years without detection.
The objective should therefore be to reduce the time between compromise and discovery.
The Impact on Marriott and Its Customers
The incident created consequences for both customers and Marriott.
Customers faced the risk associated with the exposure of personal, travel, passport and payment information.
For Marriott, the incident resulted in regulatory scrutiny and significant remediation requirements.
In 2020, the UK Information Commissioner’s Office issued Marriott with an £18.4 million penalty following its investigation into the incident. The ICO stated that approximately 339 million guest records worldwide were affected.
More recently, the US FTC took action against Marriott and Starwood over multiple data breaches. In 2024, the FTC announced a proposed settlement requiring improvements to information security practices and other protections for consumers.
The Australian Office of the Information Commissioner also investigated the incident and noted that up to 2.2 million records associated with Australian guests could have been affected.
The regulatory response demonstrates that the consequences of a major breach continue long after attackers leave the environment.
Why Exposed Data Does Not Stop Being a Risk
A password can be reset.
A compromised session can sometimes be revoked.
A stolen passport number or date of birth is different.
Personal identity information cannot simply be replaced when it appears in a breach.
That creates a long-term risk.
Once personal information has been exposed, organisations need to consider where that information could appear later.
Stolen data can be exchanged between criminal groups, used for fraud or combined with information from other breaches.
Criminal activity can also occur across different sources, including Tor, Telegram and I2P, as well as forums and marketplaces.
No single source provides complete visibility into all criminal activity.
For organisations holding large amounts of customer information, monitoring therefore needs to extend beyond the internal network.
The Lesson: Shorten the Time to Discovery
The most important lesson from Marriott is not simply to secure databases.
It is to reduce the time between exposure and discovery.
The Starwood compromise lasted for years.
During that period, attackers had opportunities to move through the environment and access valuable information.
Modern security teams need visibility into both internal activity and external exposure.
If customer information appears in criminal intelligence, the organisation should know.
If employee credentials appear in stealer logs, the security team should be able to investigate.
If corporate information appears on criminal forums or marketplaces, defenders need a way to identify it and assess the risk.
This is where dark web monitoring for business can support the wider security programme.
External monitoring does not replace endpoint security, identity controls or network monitoring.
It adds another perspective.
It asks what attackers and criminal groups may already know about the organisation.
What Organisations Can Learn From Marriott
There are several practical lessons from the incident.
1. Treat acquired systems as an immediate security priority
An acquisition should trigger a security assessment of inherited systems, accounts, infrastructure and data.
Do not assume the acquired environment has the same security maturity as the acquiring organisation.
2. Review privileged access
Attackers used compromised credentials to move through the Starwood environment.
Privileged accounts should be protected with strong authentication, least privilege and appropriate monitoring.
3. Monitor for unusual activity
Logging and monitoring can help identify abnormal access patterns.
The FTC specifically identified inadequate logging and monitoring among the security issues it alleged in its investigation.
4. Know what customer data is exposed
Organisations should maintain a clear understanding of the personal information they store, where it is located and who can access it.
Data minimisation can also reduce the impact of a compromise.
5. Monitor external exposure
The organisation’s security team cannot only watch what happens inside its systems.
Stolen credentials and customer information can surface outside the organisation.
Enterprise dark web monitoring can help identify relevant external exposure and provide security teams with information they can investigate.
How Dark Web Monitoring Helps Shorten the Window
Dark web monitoring is not a replacement for preventing breaches.
Its value comes after information has escaped.
If credentials, customer data or other sensitive information appear in criminal sources, early notification gives defenders an opportunity to respond.
That response could include resetting credentials, revoking sessions, investigating affected accounts, notifying relevant stakeholders and assessing whether the information can be linked to an active compromise.
DarkThreatX monitors 100B+ records and 1M+ new stealer logs per week across relevant criminal intelligence sources.
Monitoring operates 24/7, with alerts delivered in under five minutes and zero false positives.
Relevant activity can surface across Tor, Telegram and I2P, along with forums and marketplaces. No single source has full coverage, which is why monitoring across multiple sources matters.
The objective is straightforward.
Find exposure before attackers can turn it into an incident.
Conclusion
The 2018 Marriott data breach was not simply a story about a large database being stolen.
It was a story about time.
Attackers gained access to the Starwood environment around 2014 and remained undetected until 2018. During that period, they had opportunities to move through the network and access valuable guest information.
The breach initially appeared to affect up to 500 million guests, although Marriott later revised the upper limit to approximately 383 million records and noted that this did not represent 383 million unique people.
The incident also demonstrates why acquisitions need to include cybersecurity due diligence and why security teams need visibility into environments they inherit.
Most importantly, it shows why reducing the time to discovery matters.
Attackers benefit from every day they remain undetected.
Security teams benefit from every day they can remove compromised credentials, investigate suspicious activity and identify exposed data earlier.
The lesson from Marriott is therefore simple: do not measure security only by whether an attacker gets in. Measure how quickly you can find them when they do.
Frequently Asked Questions
How many people were affected by the Marriott breach?
Marriott initially estimated that information relating to up to 500 million guests could have been involved. After further analysis, Marriott revised the upper limit to approximately 383 million guest records, noting that some guests had multiple records and that the figure did not represent unique individuals.
How long did the Marriott breach go undetected?
The Starwood environment was compromised around 2014 and the intrusion was not detected until September 2018. The FTC later determined that attackers had remained undetected for more than four years, including the period after Marriott acquired Starwood in 2016.
What data was stolen in the Marriott breach?
The compromised information varied between guests but included names, addresses, email addresses, telephone numbers, dates of birth, loyalty information, reservation details and travel information. Passport numbers and payment card information were also involved, including approximately 5.25 million unencrypted passport numbers according to the FTC.
What is the lesson from the Marriott breach?
The key lesson is to reduce the time between compromise and discovery. Organisations should assess inherited systems during acquisitions, protect privileged accounts, maintain effective logging and monitoring, and monitor external sources for exposed credentials and data. The longer attackers remain undetected, the more opportunity they have to access sensitive information.
