FTC: Marriott and Starwood, data breaches data breach case

Decision

Regulator

FTFederal Trade Commission

acted against

Against

Marriott International, Inc.

The FTC alleged lax security led to three breaches from 2014 to 2020 affecting more than 344 million customers worldwide.

Related cases

Data breachDecidedfiled Dec 2025ICO fine: LastPass, 2022 breachThe ICO found weak security let a hacker who compromised employee laptops in August 2022 reach a backup database holding data of up to 1.6 million UK users.GBP 1.2 millionUK Information Commissioner's OfficeData breachActivefiled Aug 2025In re Coinbase Customer Data Security Breach LitigationConsolidated suits over the 2025 incident in which bribed overseas support agents leaked Coinbase customer data used in social engineering scams.S.D. N.Y.Data breachDecidedfiled Jun 2025ICO fine: 23andMe, genetic data breachJoint ICO and Canadian privacy commissioner investigation into the 2023 credential stuffing attack that exposed data of 155,592 UK residents; the ICO found security measures were inadequate.GBP 2.31 millionUK Information Commissioner's OfficeData breachActivefiled Apr 2025In re PowerSchool Customer Data Security Breach LitigationConsolidated suits over the December 2024 breach of PowerSchool's student information system that exposed data of students and teachers across many school districts.S.D. Cal.Data breachSettledfiled Jan 2025FTC: GoDaddy, hosting securityThe FTC alleged that since 2018 GoDaddy failed to use reasonable security for its web hosting services, leading to breaches, while claiming strong protection.US Federal Trade CommissionData breachDecidedfiled Dec 2024DPC fine: Meta, 2018 Facebook breachTwo inquiries into a September 2018 Facebook data breach that affected about 29 million accounts worldwide, around 3 million in the EU/EEA, covering breach notification and data protection by design.EUR 251 millionIrish DPCData breachActivefiled Oct 2024In re Snowflake Data Security Breach LitigationConsolidated suits over the 2024 theft of customer data from Snowflake cloud accounts lacking multifactor authentication, affecting customers including AT&T, Ticketmaster and Advance Auto Parts.D. Mont.Data breachDecidedfiled Sep 2024DPC fine: Meta, plaintext passwordsInquiry launched in April 2019 after Meta notified the DPC that it had stored some social media users' passwords in plaintext on internal systems.EUR 91 millionIrish DPC