Marriott International Inc.

Marriott International was fined for a data breach originating from a compromise of the Starwood Hotels reservation system that dated to 2014, remained undetected until 2018, and ultimately exposed approximately 339 million guest records worldwide including around 7 million UK residents. The ICO found Marriott failed to conduct adequate due diligence when it acquired Starwood in 2016 and failed to implement adequate security measures on the inherited systems post-acquisition. The fine was reduced from an initial notice of £99.2 million following co-operation with the investigation.