CASE-14 · Case Study — Marriott: Four Years Unseen

What happened

On 30 November 2018, Marriott disclosed a breach of the Starwood guest-reservation database. The headline was the scale — around 383 million guest records — but the more instructive fact was the age of the intrusion. The attackers had not just arrived. Investigators traced their access back to roughly 2014, meaning an unauthorized presence had lived inside the reservation system for about four years before anyone noticed.

The twist sits in the middle of that timeline. Marriott acquired Starwood in 2016. At the moment that deal closed, the attackers were already inside Starwood's environment. The compromise was not something that happened to Marriott after the fact — Marriott inherited it, undetected, when it absorbed the company. The due-diligence process that vetted the acquisition never surfaced the intrusion, so a live breach was folded into the combined business and kept running for two more years.

See it — the four-year timeline

timeline
    title Four Years Unseen
    2014 : Attackers enter the Starwood database
    2016 : Marriott acquires Starwood : Intrusion missed in due diligence
    2018 : Breach discovered : ~383M records exposed

The root cause

Two failures stacked on top of each other. The first was the absence of continuous detection. An unauthorized presence that persists for roughly four years is not a fast smash-and-grab; it is a slow, quiet tenancy that only survives because nothing is watching for it. No alert fired, no threat hunt turned it up, and the intruders had all the time they needed. In detection terms, the dwell time — the gap between compromise and discovery — was measured in years.

The second failure was that this blind spot was carried across a corporate boundary. When Marriott acquired Starwood in 2016, the acquisition did not include a security assessment deep enough to find an active adversary in the target's systems. So the buyer inherited the seller's unexamined risk. An acquisition transfers not just customers and revenue but every latent compromise the acquired company is already carrying — and here, that compromise came along for the ride, invisible.

The control that would have stopped it

Three controls, any of which would have changed the outcome. Continuous detection and threat hunting is the direct answer: proactive hunting through reservation-system access and behavior would have had four years of chances to notice an intruder that persistent, rather than waiting for an external trigger. Detection is not a feature you bolt on after an incident; it is the thing that turns a four-year breach into a four-day one.

M&A security due diligence is the control that fits the specific shape of this case. Before absorbing Starwood's systems, a security assessment — hunting for existing compromise in the target environment, not just reviewing policies on paper — is how you avoid inheriting a live breach with your eyes closed. Encryption with keys protected separately is the backstop: some of the exposed data was encrypted, but Marriott could not rule out that the keys were taken too. Encryption only protects data when the keys stay out of the attacker's reach — key management is what makes ciphertext actually useless to a thief.

The blast radius

Around 383 million guest records were affected. The exposed data included the kind of information a reservation system holds, and for some guests it reached into passport numbers. Some of the data had been encrypted, but Marriott could not confirm that the encryption keys had stayed protected — leaving open the possibility that even the encrypted fields were readable by whoever held the stolen material. The breach became one of the largest disclosures of guest data on record, and it triggered regulatory action, including a penalty notice from the UK Information Commissioner's Office.

See it

The timeline diagram above tells the whole story in three beats: entry in 2014, an acquisition in 2016 that walked past the intrusion, and discovery in 2018. The gap between the first and last dot is the number that matters — years of undetected access, spanning a change of ownership that should have been a natural checkpoint to catch it.

The lesson

When you acquire a company, you acquire its breaches too — so hunt before you buy, and never assume silence means safety.

Where it rhymes

This is a detection failure at its core, the same class as ATT&CK's emphasis on adversary dwell time — the longer an intruder goes unseen, the more the defender has already lost. It maps to the discipline of M&A security due diligence: a merger is a moment of maximum inherited risk, and the acquired environment must be threat-hunted, not just paper-reviewed, before it is trusted. It rhymes with every silent-failure story where the real damage is not the event but the months or years before anyone notices — green dashboards over a system that has been quietly owned the whole time. The countermeasure is the same everywhere: continuous detection, real threat hunting, and encryption whose keys are guarded as carefully as the data.

Named concepts: dwell time, continuous detection, M&A security due diligence, threat hunting, encryption key protection