• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Jobs
  • Career
    • Cyber Security Training
    • Work from Home
    • Cyber Security Analyst
    • Remote Work – Six Ways to Keep Your Data Safe When Working Remotely
  • Field Guide
  • Newsletter Signup
  • Deals
  • News
AskCyberSecurity.com

AskCyberSecurity.com

Cyber Security News & Information

  • Home
  • Data Privacy
    • Gamers
    • Government Cyber Security
      • Legislation
      • Standards
        • What are the risks of computer security?
        • Medical Cyber Security
    • Social Media
  • Security
    • Data Breaches
    • Scams
    • Malware
  • Software
    • Apps
    • Web Browsers
  • Glossary
    • Cyber Security Acronyms
  • About Ask Cyber Security
    • Authors
    • Contact Us
  • VPN
    • How Do I Know If My VPN is Working?
    • Best Free VPN iPhone
    • Why Use a VPN?
    • NordVPN vs IPVanish
    • Private Internet Access Download
    • Best VPN for Streaming
      • TikTok VPN
    • VPN Porn
    • Computer Security Software – What You Really Need
  • Tutorials
AskCyber Home » News » News » Marriott Fined £18.4 M for GDPR Privacy Data Breach

Marriott Fined £18.4 M for GDPR Privacy Data Breach

2020-11-02 by Michelle Dvorak

Marriott Data Breach UK ICO Penalty

UK Levies Second Largest Privacy Fine for Marriott Data Breach

TheU.K. Information Commissioner’s Office (ICO) announced a £18.4 million penalty for the Marriott Data Breach. The sensitive data of millions of Marriott customers was stolen when a cyber attack compromised the company’s website for years. The penalty was issued under the Data Protection Act 2018 for infringements of the General Data Protection Regulation (GDPR).

The Marriott data breach involved over 330 million hotel guests worldwide including several million customer records belonging to citizens of the United Kingdom.

The penalty deals with failures by Marriott regarding the security principle says the UK ICO.

Marriott Data Breach – How it Happened

In November 2018 Marriott International Inc revealed that hackers had compromised the Starwood Hotels guest reservation system. The cyber attack began in 2014 and went undetected until September 2018. The personal information of about 339 million customers was stolen during the prolonged cyber attack.

To compromise the Starwood reservation system, the attackers installed a web shell on a compromised device which gave them the ability to control the device remotely. They installed malware and gained persistent remote access to the compromised network. They then used other cyberattack tools to access and exfiltrate customer data from the hotel reservation system.

See Marriott Data Breach (Again!) 5.2 Million Customers’ Data Hacked

Compromised personal data included:

  • Names
  • Email addresses
  • Phone numbers
  • Unencrypted passport numbers
  • Arrival/departure information
  • Guest VIP status
  • Loyalty program membership number

Although the attack started in 2014, The GDPR are penalty deals with the Marriott data breach from 25 May 2018 under new GDPR rules.

“The ICO’s investigation found that there were failures by Marriott to put appropriate technical or organisational measures in place to protect the personal data being processed on its systems, as required by the General Data Protection Regulation (GDPR),” says the U.K. Information Commissioner’s Office.

The UK ICO says the attacker has not been identified.

See China Suspected in Marriott Hack

What is GDPR?

The General Data Protection Regulation, known as GDPR, is a European Union regulation that dictates how personal data is handled. The EU regulation helps protect individual’s information such as name, email address birthdates, ID numbers, and any other personally identifying information used online by organizations. There are provisions for how long data can be stored and the ability for people to demand that all of their data be deleted any time they choose.

Companies found in violation of GDPR can be fined up to four percent of their annual revenue or €20 million.

Filed Under: News Tagged With: EU, GDPR, Marriott, Ryuk

About Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers


LinkedInTwitterFacebook

Primary Sidebar

Subscribe to Our Free Newsletter

We Don't Share or Sell Your Info

Web Browsers

Where Are My Saved Passwords in Chrome?

Google Removes 70 Malicious Browser Add-ons from Chrome Web Store

Firefox 75 Reports Your Browser Settings to Mozilla

Categories

Cyber Security Field Guide

Computer Security While TravelingGet Our Cyber Security Field Guide - Available on Amazon!

Recent Posts

Google Says Advertisers Don’t Need to Track Individual Across the Web

Malaysia Airlines Reports Data Breach

Intelligence Manager – Emerging Threats

Email Scam Impersonates Your HR Department

FTC Warns of COVID Vaccine Scam Text Messages

IPVanish

IPVanish VPN

Cyber Security News

Google Says Advertisers Don’t Need to Track Individual Across the Web

… [Read More...] about Google Says Advertisers Don’t Need to Track Individual Across the Web

Malaysia Airlines Reports Data Breach

… [Read More...] about Malaysia Airlines Reports Data Breach

Email Scam Impersonates Your HR Department

… [Read More...] about Email Scam Impersonates Your HR Department

Microsoft Releases Open Source Tool to Root Out SolarWinds Malware

… [Read More...] about Microsoft Releases Open Source Tool to Root Out SolarWinds Malware

More Cyber Security News

Tags

amazon Android app Apple bitcoin China chrome CISA credit card Cyber Attack DHS Equifax Europe Facebook facial recognition FBI Firefox FTC games GDPR Google Government hacker identity theft India iPhone Iran IRS LinkedIn Microsoft North Korea PayPal phishing phishing email ransomware Romance Scam Russia smartphone tax scam TikTok tutorial VPN WhatsApp WiFi Windows

Government

FTC Releases Cyber Threat Video Playlist

Malware Found on US Government Funded Phones

UK NCA Reaches Out to Youth to Deter Cybercrimes

Texas DOT Hit by Ransomware Attack

More Posts from this Category

Footer

Menu

  • Home
  • About
  • Authors
  • Newsletter Signup
  • PRIVACY POLICY

Search

Why Use a VPN?

NordVPN vs IPVanish VPN Review

NAVIGATION

  • Data Breaches
  • Data Privacy
  • Gamers
  • Scams
  • Malware

MEMBER NJCCIC

New Jersey Cybersecurity & Communications Integration Cell

STAY CONNECTED

  • Facebook
  • Instagram
  • Pinterest
  • YouTube
  • Twitter
  • RSS

Copyright © 2021 · AskCyberSecurity.com · METRONY, LLC

Go to mobile version