Marriott International

Disclosed Nov 30, 2018500,000,000 affectedSettled

Starwood reservation database breach; UK ICO fine, FTC order and USD 52M states settlement

Attackers had been in Starwood's guest reservation database since 2014, before Marriott bought Starwood, exposing up to 339 million guest records including passport numbers until discovery in November 2018. The ICO issued a final fine of about USD 23.8M in October 2020, down from a proposed GBP 99M, and in October 2024 the FTC ordered a security program while 50 attorneys general secured USD 52M over this and other breaches.

What is known

People affected	500,000,000 (as reported by the organization)
Disclosed	Nov 30, 2018
Discovered	Nov 19, 2018
Happened	Sep 10, 2018
Attack	Hacking
Data exposed	NamesAddressesPhone numbersEmailsGovernment IDsDates of birthPayment cardsOtherFinancial
Sector	Hospitality · US
Status	Settled
Lawsuit or fine	ICO fine of about USD 23.8M (Oct 2020); USD 52M multistate AG settlement and FTC order (Oct 2024) (about $76M)

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Marriott International

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Marriott International

Newsbbc.co.uk

Marriott Hotels fined 18.4m GBP for data breach that hit millions

SEC filingsec.gov

Marriott Announces Starwood Guest Reservation Database Security Incident (8-K Ex. 99)

Regulatorag.ny.gov

NY AG: USD 52 Million multistate settlement with Marriott

Newsen.wikipedia.org

Marriott International (Wikipedia)

Regulatorportal.ct.gov

Connecticut AG: USD 52 Million Multistate Settlement with Marriott

Newstechcrunch.com

Marriott says 500 million Starwood guest records stolen in massive data breach

Newstechcrunch.com

UK watchdog reduces Marriott data breach fine to $23.8M

Regulatorftc.gov

FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches

Official noticein.gov

Indiana Attorney General 2018 data breach report: Marriott International

Official noticemaine.gov

Maine Attorney General breach notice archive: Marriott International

Notices filed

Residents of CANov 30, 2018

California AGCount not stated

Residents of ORNov 30, 2018

Oregon DOJ500,000,000 people

TotalNov 30, 2018

Research500,000,000 people

TotalNov 30, 2018

ResearchCount not stated

Residents of INNov 30, 2018

Indiana AG500,000,000 people

Residents of MENov 30, 2018

Maine AGCount not stated

Other breaches at Marriott International

Social engineering at a Marriott hotel leads to theft of guest and card dataPhishing exposed payment cards and internal documents.PhishingHospitalityUSUnverifiedJul 6, 2022 Breach, details not statedBreach notice filed with the California AG, details not stated.2,589 affectedHospitalityUSOct 30, 2019 Breach, details not statedBreach notice filed with the Indiana AG, details not stated.75 affectedHospitalityUSOct 16, 2017 Breach, details not statedBreach notice filed with the Indiana AG, details not stated.70 affectedHospitalityUSOct 19, 2015

History of this record

notice_affected2026-09-25

empty to in-ag: 500000000 (restored: the portal's own figure)by correctionSource

notice_affected2026-09-25

empty to or-doj: 500000000 (restored: the portal's own figure)by correctionSource

notice_affected2026-09-25

in-ag: 500000000 to by correctionSource

notice_affected2026-09-25

or-doj: 500000000 to by correctionSource

data_types2026-09-25

["names","addresses","phone","emails","government-id","dob","payment-card","other"] to ["names","addresses","phone","emails","government-id","dob","payment-card","other","financial"]by backfillSource

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2018.pdfby backfillSource

fine_usd2026-09-25

empty to 75800000by seedSource

lawsuit2026-09-25

18.4M GBP ICO GDPR fine (2020) to ICO fine of about USD 23.8M (Oct 2020); USD 52M multistate AG settlement and FTC order (Oct 2024)by seedSource

data_types2026-09-25

["names","addresses","phone","emails","government-id","dob","payment-card"] to ["names","addresses","phone","emails","government-id","dob","payment-card","other"]by seedSource

summary2026-09-25

Marriott said there had been unauthorized access to the Starwood guest reservation network since 2014, affecting up to about 500 million guests; for about 327 million the data included passport numbers and other details, and some records he to Attackers had been in Starwood's guest reservation database since 2014, before Marriott bought Starwood, exposing up to 339 million guest records including passport numbers until discovery in November 2018. The ICO issued a final fine of abby seedSource

title2026-09-25

Starwood reservation database breach exposes up to 500 million guests to Starwood reservation database breach; UK ICO fine, FTC order and USD 52M states settlementby seedSource

status2026-09-25

confirmed to settledby seedSource

lawsuit2026-09-25

empty to 18.4M GBP ICO GDPR fine (2020)by seedSource

attack2026-09-25

unknown to hackingby seedSource

data_types2026-09-25

[] to ["names","addresses","phone","emails","government-id","dob","payment-card"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 500000000by seedSource

summary2026-09-25

empty to Marriott said there had been unauthorized access to the Starwood guest reservation network since 2014, affecting up to about 500 million guests; for about 327 million the data included passport numbers and other details, and some records heby seedSource

title2026-09-25

empty to Starwood reservation database breach exposes up to 500 million guestsby seedSource

discovered2026-09-25

empty to 2018-11-19by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Marriott International