FTC orders Marriott and Starwood to implement strict data security

The FTC has finalized a 20-year order requiring Marriott and Starwood to implement a comprehensive data security program within 180 days after repeated failures left customer data exposed in multiple breaches—most notably a Starwood reservation-database compromise inherited by Marriott that affected approximately 339–344 million guest records, including unencrypted passport numbers. The order mandates encryption, access controls, MFA, monitoring and logging, retention limits, consumer deletion and review mechanisms, biennial independent assessments, and strict breach notification/reporting requirements; Marriott also agreed to a $52 million settlement related to these incidents.