The Information Commissioner’s Office (ICO) has fined the group for failing to keep an estimated 339 million worldwide guests’ records secure – seven million in the UK alone.

Personal data exposed may have included names, email addresses, phone numbers, unencrypted passport numbers, arrival/departure information, guests’ VIP status and loyalty programme membership number.

Marriott revealed an internal investigation had shown that a hacker had been able to access the guest reservation database of its Starwood division in the US since 2014. Marriott acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018.

The ICO’s investigation found there were failures by Marriott to put appropriate technical or organisational measures in place to protect the personal data being processed on its systems, as required by the General Data Protection Regulation (GDPR).

While the attack was traced back to 2014, the £18.4m penalty only relates to the breach from 25 March 2018, when new rules under GDPR came into effect.

The ICO said Marriott acted promptly to contact customers and the ICO about the breach. It also acted quickly to mitigate the risk of damage suffered by customers, and has since instigated a number of measures to improve the security of its systems.

Information commissioner, Elizabeth Denham, said: “Personal data is precious and businesses have to look after it. Millions of people’s data was affected by Marriott’s failure; thousands contacted a helpline and others may have had to take action to protect their personal data because the company they trusted it with had not.

“When a business fails to look after customers’ data, the impact is not just a possible fine, what matters most is the public whose data they had a duty to protect.”

The fine of £18.4m was reduced from the original fine of £99m when the ICO published an intent to fine notice in July 2019.

‘Marriott deeply regrets the incident’

Marriott said it does not intend to appeal the decision and noted that the decision does not find any evidence of harm to any individuals.

A Marriott International spokesperson, said: “Marriott remains committed to the privacy and security of its guests’ information and continues to make significant investments in security measures for its systems.

“The ICO recognises the steps taken by Marriott following discovery of the incident to promptly inform and protect the interests of its guests.”