In November 2018, Marriott disclosed a breach in its Starwood reservation database affecting approximately 500 million guests. The compromise had persisted since 2014, undetected through the acquisition of Starwood by Marriott. The incident exposed risks inherent in legacy systems, merger integration, and data governance.
1. Legacy Systems and the Acquisition
The intrusion originated in the Starwood guest reservation database, a legacy system that predated the Marriott acquisition. The gap between acquisition and integration meant the compromised environment operated under divergent security standards and monitoring. Legacy systems often carry technical debt, unpatched components, and weak access controls that expand the attack surface.
2. Encryption and Data Protection Failures
The exposed data included payment card numbers. Although portions were encrypted, the encryption was not consistently applied, and critical records were stored in plaintext. The compromised data also included names, addresses, and passport numbers. Inconsistent encryption across a heterogeneous estate is a common failure where individual fields are protected but the broader dataset is not.
3. Detection and Integration Gaps
The attackers accessed the database for years without detection. The fragmentation between the legacy Starwood environment and Marriott's security operations created blind spots in telemetry and monitoring. Detection tools were not fully deployed to the acquired environment, and data access was not adequately governed or audited.
4. Prevention and Governance Controls
Preventing a similar breach requires rigorous due diligence during acquisitions, including security assessments of legacy assets. Consolidate and encrypt data consistently, deploy monitoring across all environments, and enforce strict data access governance. Minimize the retention of sensitive data and implement strong key management and access auditing.
The Marriott breach demonstrates that data governance and legacy system management are security imperatives. Consistent encryption, comprehensive monitoring, and disciplined integration are essential to preventing long-dwell-time compromises.
