The Marriott Security Breach: A Comprehensive Analysis of Cybersecurity Failures and Corporate Responsibility

This research paper provides a comprehensive analysis of the Marriott security breach, one of the largest cybersecurity incidents of the 21st century. The breach, which remained undetected for over four years, compromised the personal information of 383 million hotel guests following Marriott's acquisition of Starwood Hotels. This study examines the technical aspects of the attack, including the use of Remote Access Trojans (RAT), MimiKatz malware, and web shells that provided cybercriminals with unrestricted access to reservation systems. The investigation reveals critical security failures including insufficient monitoring, outdated AES-128 encryption, and inadequate due diligence during the corporate merger. Chinese state-sponsored actors allegedly orchestrated the attack, exfiltrating millions of passport numbers and credit card details for intelligence purposes. The breach was only discovered through an IBM Guardium Alert triggered by suspicious database queries. Legal and regulatory consequences included a £18.4 million fine from Information Commissioner's Office (ICO) in the United Kingdom under GDPR regulations, though Marriott's cyber insurance coverage significantly reduced their actual financial liability to under £1 million. The case highlights corporate responsibility failures in data protection and cybersecurity risk management. This analysis contributes to cybersecurity literature by examining the intersection of corporate acquisitions, international espionage, and data protection failures. The study provides recommendations for future-proofing hospitality industry cybersecurity, including enhanced monitoring systems, stronger encryption protocols, and comprehensive employee training against social engineering attacks. The findings demonstrate the critical importance of maintaining robust cybersecurity measures during organizational transitions and the inadequacy of current penalty structures in deterring major data breaches.