Case Study Marriott Data Breach

Case Study: Marriott Data Breach

The Marriott data breach in 2018 was a significant cyber incident that exposed the personal information of approximately 500 million guests. The breach, attributed to unauthorized access within the Starwood guest reservation database, compromised sensitive data such as names, addresses, passport numbers, and payment card details.

The incident occurred before Marriott acquired Starwood in 2016 and went undetected for several years, highlighting critical security lapses.

The aftermath involved extensive investigations, regulatory scrutiny, and legal consequences for Marriott, emphasizing the need for robust cybersecurity measures and incident response capabilities in the face of evolving cyber threats.

The breach compromised personal information, impacting the confidentiality of guest data. The unauthorized access raised concerns about the integrity of the data, and the incident's fallout affected the availability of Marriott's booking systems and customer services.

Security Governance Principles

The Marriott incident underscored governance challenges, pointing to potential gaps in overseeing and managing security controls. Questions arose about Marriott's security governance structure, board oversight, and the effectiveness of their cybersecurity program.

Marriott faced regulatory scrutiny due to the exposure of personal information, highlighting compliance failures. Investigations by regulatory bodies ensued, emphasizing the importance of complying with data protection and privacy regulations.

IT Policies and Procedures

Questions arose about Marriott's IT policies and procedures, especially regarding access controls and data protection measures. The incident highlighted potential weaknesses in their cybersecurity policies and the need for robust IT governance.

Difficulties with Information Security Law and Regulation

The breach exposed Marriott to legal and regulatory difficulties, including challenges in adhering to various information security laws and regulations globally. Navigating these complexities became a crucial aspect of Marriott's post-breach response.

Risk-Based Management Concepts

The Marriott breach had significant financial and reputational implications, emphasizing the importance of risk-based management. The incident illustrated the need for organizations to assess and prioritize cybersecurity risks based on potential impact and likelihood.