Marriott settles with FTC, to pay $52 million over data breaches

Marriott/Starwood experienced multiple, large-scale data breaches spanning 2014–2018 that exposed hundreds of millions of guest records (payment card data, passport numbers, contact details, loyalty account data). Regulators (FTC and 49 states/DC) found failures in security controls and delayed detection/notification; Marriott agreed to pay $52M and implement a comprehensive security program with ongoing assessments, data retention limits, deletion mechanisms, and transparency requirements.