Marriott International will pay $52 million and enhance its data-security features as part of a settlement with the U.S. Federal Trade Commission and the attorneys general of 49 U.S. states over a 2018 breach of customer data in the guest reservation database of its Starwood Hotels & Resorts Worldwide subsidiary, the company announced.
As part of the settlement, Marriott has agreed to provide U.S. customers with “a way to request deletion of personal information associated with their email address or loyalty rewards account number,” the FTC said in a statement, and also calls for the hotel company to restore stolen Bonvoy loyalty points if necessary after a review upon request.
Marriott in a statement said it would “continue implementing enhancements to its data privacy and information security programs, many of which are already in place or in progress,” citing a process for U.S. customers to delete personal information and report suspicious Bonvoy activity.
The settlement stems from a 2018 breach in Starwood’s guest reservation database. An investigation showed unauthorized access of Starwood’s system beginning in 2014 that exposed the personal information of about 339 million consumers, in some cases including passport numbers and payment card information. Marriott acquired Starwood in 2016.
“Marriott’s poor security practices led to multiple breaches affecting hundreds of millions of customers,” said FTC Bureau of Consumer Protection director Samuel Levine said in a statement. “The FTC’s action today, in coordination with our state partners, will ensure that Marriott improves its data security practices in hotels around the globe.”
Marriott said it made no admission of liability to the allegations. The U.K.’s Information Commissioner’s Office in 2020 fined the hotel company nearly $24 million over the same breach.
