GUWonder

Doesn't change the fact that mergers/acquisitions draw down IT resources in an environment where even the bandwidth to apply such resources may be challenged by the needs of management pursuing an M&A and are challenged when it comes to actual integration and delivering to the cost-cut targets the M&A peddlers sold to financial market participants. Absent the Marriott acquisition of Starwood, the data breaches almost certainly wouldn't have been as bad as with the Marriott acquisition of Starwood.

This has nothing to do with Starwood IT being better than Marriott IT or the other way around; it has to do with what happens in the real world of operational integration post-acquisition and what risks M&A activity create/exacerbate in that regard.

It could be spun that way, but I doubt that a lot of Marriott IT employees are going to see a big bonus coming there way because of this issue being identified.

The data breaches continued to take place even after GDPR became the proverbial law of the land in the EU. So just because a breach method commenced prior to GDPR becoming the law of the land doesn't free Marriott (inclusive of Starwood) from its GDPR compliance requirements for breaches that continued after GDPR became the law of the land.

jr1202sr

Ridiculous to say this Predates Marriott ownership of Starwood Soley. They day they Merged is the Day Marriott was responsible for Starwood (and any legacy issues). That is why you perform DD before you make a Purchase the size of Starwood.

Marriott has failed to integrate the 2 companies in a timely manner and in a way that doesn't impact their customers. This is just another mistake in the long list.

stimpy

True. It makes you wonder why Marriott didn't do a thorough security audit before the merger? They could have spent $1m on an audit and saved much more in fines that may arise from this breach.

estedman

Yes the merger integration has been mess but this one has been going since 2014, that's before Marriott even announced they were buying Starwood. The breach was probably found when they were merging computer systems.

UKTraveller4Fun

I am not a fan of Marriott and certainly been vocal about how poor the merger has been and the leadership failures of Marriott in the process. It has been pretty much a disaster and a continuing one at that!

That said I feel soe of the comments here holding Arne & Marriott to blame for this are somewhat unfair! Yes Marriott have a responsibility here as they have owned the company with the breach for the last 2 years! that said suggesting that some sort of audit ahead of time or that Marriott's IT should have caught this in the last 2 years when SPG's IT didnt catch it happening in the first place or for the 2 years that followed prior to the merger is in my opinion not fair or reasonable.

It is far harder to identify these things after the event then when they are actually happening and being created, add in that the people who should have known SPG IT the best are SPG tech not external Marriott tech it would make it even harder.

I am all for bashing Marriott when they fully deserve it but on this I feel by using it as an excuse to bash them some more about the merger issues actually reduces the integrity of complaining about the merger issues!

That all said Marriott now have to step up and deal with this and those affected in a proper and correct way not trying to sidestep and avoid like they seem to try and do. If they dont do that then they deserve all the negativity they get as it is now their responsibility even if it didn't start with them!

flying_geek

GUWonder

I find that BODs and C-suite types are more willing to gamble on spending bigger bucks per outside finance players for hire and for sales activities than on cutting back a little there and on themselves so as to instead spend more on in-house IT or even outsourced IT-related purposes.

Companies with retail customers of sorts haven't yet gotten around to really caring all that much about the privacy of all of their customers, and the companies seem to still have a sort of willingness to take the lumps from IT-related failures and arising data breaches rather than splurging to avoid it going wrong at all. Maybe the GPDR-related fines will change that game, but even in Europe GDPR compliance is still a work in progress and it seems that GDPR is sort of another fad of the day for professional service firms/types to make more money while delivering very little that is concrete other than some forms for people to fill out or more fine print to read/skim/skip.

MePlatPremier

Dublin_rfk

Well said!
Even with no transactions with spg (ever) I will monitor my cards a little closer and I would still not be surprised to receive an invitation to do so again.

GUWonder

Marriott deserves its lumps on this too. Consider what Marriott was eagerly pursuing with regard to Starwood "overhead" and what that does to the IT skillset of a company and those most familiar with the systems involved. And even before that, what about Marriott's due diligence for investigating and figuring out its risk/exposure from potential privacy protection breakdowns at a target company it eagerly wanted to swallow whole? "You are what you eat" is something that M&A pursuers should consider when trying to put food on the plate.

What I'd like to see Marriott do is the following: come out and note specificially how Marriott found out about this breach that was running into the fall of this year.

fransknorge

Are we talking about 500 millions unique persons ? If so this might be the largest data breach in history no ? This is 6.5% of the globe population.

Football Fan

How come they waited so long to inform about this?

Dublin_rfk

More likely 500 millions of unique reservation transactions. So some of us have many hundreds of entries to the 'you're screwed' lottery.

GUWonder

Not 500 million unique persons. Way less than that is my suspicion. But hotel data systems have been prime targets for exploitation by criminal outfits and for governmental actors.

The adequacy/inadequacy of such due diligence is all upon Marriott. Before and after its acquisition closed.

HHonors OUTSIDER

Also it is now obvious that hackers changed Marriott Rewards new name to Bonvoy because no one at Marriott would come up with a new Program name that is so ridiculous.