The FTC's Marriott and Starwood Order: Three Breaches, Two Counts and a 20-Year Security Program

The Three Breaches the Complaint Describes

The Federal Trade Commission's final complaint names two respondents: Marriott International, Inc., a Delaware corporation in Bethesda, Maryland, and its wholly owned subsidiary Starwood Hotels & Resorts Worldwide, LLC. It describes Marriott as managing and franchising 30 brands and more than 7,000 properties across 131 countries and territories. Marriott announced the Starwood acquisition, a $12.2 billion deal, on or about November 16, 2015 and closed it on or about September 23, 2016. From that point, the complaint says, Marriott controlled Starwood's network and was responsible for the security practices of both companies, and it fully integrated certain Starwood systems into its own network by December 2018.

First breach: Starwood payment cards, 2014 to 2015

Beginning in June 2014 and continuing for 14 months, an intruder exploited vulnerabilities to reach Starwood's network, compromised unprotected administrative accounts and installed malware at more than 100 Starwood owned or managed hotels. The malware captured names, card numbers, expiration dates and security codes. About four days after the acquisition announcement, on or about November 20, 2015, Starwood notified consumers of a breach affecting more than 40,000 of them. The forensic examination Starwood commissioned found inadequate firewalls and network segmentation, inadequate access controls, outdated and unsupported software, and no multifactor authentication. The complaint adds that Marriott reviewed Starwood's security program, including these failures, during the 10 months before closing.

Second breach: the Starwood reservation system, 2014 to 2018

On or about July 28, 2014, according to the complaint, intruders compromised an external-facing Starwood webserver, installed malware, harvested highly privileged credentials and moved through the internal network for four years. They installed key loggers, memory-scraping malware and remote access trojans on more than 480 systems across 58 corporate, data center, contact center and hotel locations. Marriott's systems detected an attempt to export data from the guest reservation database on September 7, 2018, nearly two years after closing, and the intruders exported more guest data on September 10. The forensic examiner found failures similar to the first breach, plus unencrypted payment card data stored outside the secure cardholder data environment and inadequate logging. The complaint puts the result at 339 million consumer records globally, including more than 5.25 million unencrypted passport numbers, along with names, birth dates, payment card numbers, contact details, loyalty numbers and travel information such as stay locations and flight details.

Third breach: Marriott's own network, 2018 to 2020

Marriott announced in March 2020 that intruders had used the credentials of employees at a Marriott-franchised property to reach Marriott's network. The complaint says they accessed and exported guest data without detection from September 2018, the month Marriott learned of the Starwood intrusion, through December 2018, then resumed in January 2020 until discovery in February 2020. They reached more than 5.2 million guest records, 1.8 million of them relating to U.S. consumers. Marriott's internal investigation, according to the complaint, confirmed that the main purpose was to find loyalty accounts holding enough points to use or redeem.

The Section 5 Counts

The deception count rests on two privacy policies. The Starwood policy, which Marriott continued to operate until it merged the Starwood website into its own around May 2018, said Starwood safeguarded information "using appropriate administrative, procedural and technical safeguards," including password controls, firewalls "and the use of up to 256-bit encryption." The Marriott policy said, "We seek to use reasonable organizational, technical and administrative measures to protect Personal Data." Count I alleges that these statements represented that the companies used appropriate safeguards, and that they did not.

The factual core of both counts is paragraph 27, which alleges that the respondents failed to provide reasonable security in seven ways:

• Password controls, with employees often using default, blank or weak passwords
• Patching, including unsupported operating systems in the Starwood cardholder data environment for which patches were no longer available
• Monitoring and logging, which the complaint says kept the companies from detecting intruders for years and from determining what was taken
• Access controls, including former employees' accounts left active and no unique accounts for remote access
• Firewall controls, allowing unauthorized connections from outside
• Network segmentation, letting intruders move between hotel property systems and the corporate network
• Multifactor authentication, which Starwood's contracts and internal policies required for remote access to sensitive environments but which the complaint says was not applied

Count II alleges that this failure was unfair: it caused or was likely to cause substantial injury not outweighed by benefits and not reasonably avoidable, because consumers had no way to know about the security failures. The injury section is specific to hotels. It says loyalty accounts are more exposed to fraud than payment cards because points carry value, account numbers are static and consumers rarely monitor them, that criminals pay more for loyalty data than card data, and that consumers lack the legally protected recovery rights that apply when a card is misused. It also describes stolen passport numbers combined with other records as fuel for targeted phishing and identity theft, and lists the time and money consumers spent on protection services, monitoring, passport replacement and card replacement.

The Information Security Program the Order Requires

The final Decision and Order opens with a conduct ban. Provision I bars the respondents from misrepresenting how they collect, maintain, use, delete or disclose personal information, or how far they protect its privacy, security, availability, confidentiality or integrity. The order's definition of "Marriott" excludes franchised hotels owned and operated by third parties and subsidiaries incorporated and operating outside the United States.

Provision II requires a comprehensive information security program within 180 days of the order's effective date. It must be in writing, go to the board or equivalent governing body at least annually, and be run by a designated qualified employee. Risk assessments are required at least annually and within 120 days after a Covered Incident, which the order defines as a security event that Marriott is legally required to report to a U.S. federal, state or local government entity. The board must also receive a report within 120 days of any such incident. The program must then include specific safeguards, among them:

• Annual role-appropriate training, plus policies requiring franchised hotels to train their own employees who can reach Marriott systems
• A written incident response plan
• Logging and monitoring tools such as a security information and event management system, with logs reviewed for anomalous activity within 24 hours
• Access controls that restrict connections, enforce strong passwords, block reuse of credentials known to be compromised, force resets of those credentials and apply least privilege
• Multifactor or equivalent authentication for remote access by employees and vendors, and as an option for U.S. consumer accounts, with any data collected for that purpose used only for authentication
• Hardening standards for operating systems and network devices outside the property network segments, encryption or tokenization where identified, asset inventories, and removal or encryption of data on retired equipment
• Patch management with timelines tied to severity, and timely remediation of critical and high-risk vulnerabilities

Testing obligations follow: quarterly internal and external vulnerability scans, and at least annual penetration, segmentation and web application testing, with each also triggered within 120 days of a Covered Incident. The respondents must contractually require vendors to safeguard data, and must require franchised hotels by contract to maintain appropriate safeguards, backed by a risk-based audit program. Provision II.G addresses the history the complaint describes. After closing any acquisition of a company that handles personal information, the respondents must assess whether its security program meets the order's terms, then plan to fix the gaps, and the plan must address an acquired company's systems before they are used in Marriott's production environment.

Data Minimization, Deletion and Loyalty Accounts

Provision VIII deals with data handling. Within 180 days the respondents must place a clear and conspicuous link on Marriott's website and mobile apps through which U.S. consumers can request deletion of personal information associated with an email address or loyalty program number. Receipt must be verified, and the deletion process explained, within 60 days. The provision preserves any exceptions available under state or federal law. The second half is a retention rule: personal information may be kept only as long as reasonably necessary for the purpose for which it was collected, and the privacy policy must disclose that purpose and the specific business need for keeping the data. Information need not be destroyed when a government agency requests it, when the law requires it, or for other documented legitimate business needs "except for marketing."

Provision VII responds to the loyalty theft in the third breach. The respondents must offer a clear and conspicuous way for a U.S. consumer to request review of suspected unauthorized activity in a Marriott Bonvoy account during the prior 12 months, and must also review accounts on their own after a security event involving misuse of loyalty credentials. Where a review finds that a third party's activity reduced a consumer's points, the respondents must restore them unless the consumer violated the program's terms.

Duration and Reporting

Provision III requires third-party assessments of the security program: an initial assessment covering the first 365 days after the order issued, then one for each two-year period for 20 years. The FTC's Associate Director for Enforcement approves each assessor, and the assessor may not withhold documents from the Commission on grounds of confidentiality, privilege or work product. No finding may rest primarily on management's assertions, and each report must state the hours worked by each team member. The respondents must cooperate with the assessor and disclose all material facts.

Other reporting runs alongside. The chief executive must certify compliance annually starting one year after issuance. Within 10 days of notifying any U.S. government entity of a Covered Incident, the respondents must send the FTC a report covering its timing, causes, the information involved, the number of consumers affected and the remediation taken. A sworn compliance report is due after one year, records must be created for 20 years and kept for five, and the order terminates 20 years after issuance or 20 years after the most recent federal court complaint alleging a violation, whichever is later.

The procedural record is on the FTC's case page. The Commission announced the proposed complaint and consent agreement on October 9, 2024 by a 3-0-2 vote, Commissioners Holyoak and Ferguson recused. Two comments arrived, one from the Electronic Privacy Information Center and one from an individual. In letters dated December 20, 2024, the Commission said it would issue the complaint and order "in final form without any modifications," and the order bears an issue date of December 20, 2024. The order contains no payment. The FTC's October release states that it "does not have legal authority to obtain civil penalties in this case," and that Marriott separately agreed to pay $52 million to 49 states and the District of Columbia. The terms of that parallel state settlement, including how its 20-year information security mandate and assessment schedule differ from this order, are covered in the Marriott multistate attorney general settlement.

Frequently Asked Questions