• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Jobs
  • Career
    • Cyber Security Training
    • Work from Home
    • Cyber Security Analyst
    • Remote Work – Six Ways to Keep Your Data Safe When Working Remotely
  • Field Guide
  • Newsletter Signup
  • Deals
  • News
AskCyberSecurity.com

AskCyberSecurity.com

Cyber Security News & Information

  • Home
  • Data Privacy
    • Gamers
    • Government Cyber Security
      • Legislation
      • Standards
        • What are the risks of computer security?
        • Medical Cyber Security
    • Social Media
  • Security
    • Data Breaches
    • Scams
    • Malware
  • Software
    • Apps
    • Web Browsers
  • Glossary
    • Cyber Security Acronyms
  • About Ask Cyber Security
    • Authors
    • Contact Us
  • VPN
    • How Do I Know If My VPN is Working?
    • Best Free VPN iPhone
    • Why Use a VPN?
    • NordVPN vs IPVanish
    • Private Internet Access Download
    • Best VPN for Streaming
      • TikTok VPN
    • VPN Porn
    • Computer Security Software – What You Really Need
  • Tutorials
  • ChatGPT
    • Does ChatGPT Save Data?
AskCyber Home » News » News » Marriott Fined £18.4 M for GDPR Privacy Data Breach

Marriott Fined £18.4 M for GDPR Privacy Data Breach

2020-11-02 by Michelle Dvorak

Marriott Data Breach UK ICO Penalty

UK Levies Second Largest Privacy Fine for Marriott Data Breach

TheU.K. Information Commissioner’s Office (ICO) announced a £18.4 million penalty for the Marriott Data Breach. The sensitive data of millions of Marriott customers was stolen when a cyber attack compromised the company’s website for years. The penalty was issued under the Data Protection Act 2018 for infringements of the General Data Protection Regulation (GDPR).

The Marriott data breach involved over 330 million hotel guests worldwide including several million customer records belonging to citizens of the United Kingdom.

The penalty deals with failures by Marriott regarding the security principle says the UK ICO.

Marriott Data Breach – How it Happened

In November 2018 Marriott International Inc revealed that hackers had compromised the Starwood Hotels guest reservation system. The cyber attack began in 2014 and went undetected until September 2018. The personal information of about 339 million customers was stolen during the prolonged cyber attack.

To compromise the Starwood reservation system, the attackers installed a web shell on a compromised device which gave them the ability to control the device remotely. They installed malware and gained persistent remote access to the compromised network. They then used other cyberattack tools to access and exfiltrate customer data from the hotel reservation system.

See Marriott Data Breach (Again!) 5.2 Million Customers’ Data Hacked

Compromised personal data included:

  • Names
  • Email addresses
  • Phone numbers
  • Unencrypted passport numbers
  • Arrival/departure information
  • Guest VIP status
  • Loyalty program membership number

Although the attack started in 2014, The GDPR are penalty deals with the Marriott data breach from 25 May 2018 under new GDPR rules.

“The ICO’s investigation found that there were failures by Marriott to put appropriate technical or organisational measures in place to protect the personal data being processed on its systems, as required by the General Data Protection Regulation (GDPR),” says the U.K. Information Commissioner’s Office.

The UK ICO says the attacker has not been identified.

See China Suspected in Marriott Hack

What is GDPR?

The General Data Protection Regulation, known as GDPR, is a European Union regulation that dictates how personal data is handled. The EU regulation helps protect individual’s information such as name, email address birthdates, ID numbers, and any other personally identifying information used online by organizations. There are provisions for how long data can be stored and the ability for people to demand that all of their data be deleted any time they choose.

Companies found in violation of GDPR can be fined up to four percent of their annual revenue or €20 million.

Filed Under: News Tagged With: EU, GDPR, Marriott, Ryuk

About Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers


LinkedInTwitterFacebook

Primary Sidebar

Subscribe to Our Free Newsletter

We Don't Share or Sell Your Info

Web Browsers

Where Are My Saved Passwords in Chrome?

Google Removes 70 Malicious Browser Add-ons from Chrome Web Store

Firefox 75 Reports Your Browser Settings to Mozilla

Categories

Cyber Security Field Guide

Computer Security While TravelingGet Our Cyber Security Field Guide - Available on Amazon!

Recent Posts

Security Marketing Manager – Remote

Sr. Associate, Cybersecurity Architect – Pfizer

Strategic Customer Success Manager – Cybersecurity – Opportunity for Working Remotely

Top 20 Passwords Leaked on Dark Web

ISU Cybersecurity Leader Job Opening

Cyber Security News

Top 20 Passwords Leaked on Dark Web

… [Read More...] about Top 20 Passwords Leaked on Dark Web

Apple Warns of Actively Exploited Zero-Day Flaw

… [Read More...] about Apple Warns of Actively Exploited Zero-Day Flaw

IRS Stops Facial Recognition System for Online Access

… [Read More...] about IRS Stops Facial Recognition System for Online Access

National Cybersecurity Alliance Announces Data Privacy Week

… [Read More...] about National Cybersecurity Alliance Announces Data Privacy Week

More Cyber Security News

Tags

amazon Android Apple bitcoin China chrome CISA credit card DarkSide DHS DOJ Equifax Europe Facebook facial recognition FBI Firefox FTC games GDPR Google Government hacker identity theft India iPhone Iran IRS LinkedIn Microsoft North Korea PayPal phishing phishing email ransomware REvil Russia smartphone T-Mobile TikTok tutorial VPN WhatsApp WiFi Windows

Government

CBP Looks to Access Airline Passenger Data

FTC Releases Cyber Threat Video Playlist

Malware Found on US Government Funded Phones

UK NCA Reaches Out to Youth to Deter Cybercrimes

More Posts from this Category

Footer

Menu

  • Home
  • About
  • Authors
  • Newsletter Signup
  • PRIVACY POLICY

Search

Why Use a VPN?

NordVPN vs IPVanish VPN Review

NAVIGATION

  • Data Breaches
  • Data Privacy
  • Gamers
  • Scams
  • Malware

MEMBER NJCCIC

New Jersey Cybersecurity & Communications Integration Cell

STAY CONNECTED

  • Facebook
  • Instagram
  • Pinterest
  • YouTube
  • Twitter
  • RSS

Copyright © 2023 · AskCyberSecurity.com · METRONY, LLC

Go to mobile version