Marriott International CEO Arne Sorenson faced U.S. Senate investigators over a data breach affecting up to 383 million guests, admitting the company could not confirm if Chinese state actors were responsible. The incident involved compromised Starwood Hotels reservation systems, with Sorenson stating the firm had focused on securing its networks rather than assigning blame.
Sorenson testified that the breach spanned four years, with the company first detecting anomalies in September 2018. Marriott notified the FBI in October and publicly disclosed the issue on November 30, 2018. The CEO emphasized the firm had accelerated the decommissioning of the Starwood system, completing the process by December 2018.
Senate investigators highlighted that Starwood had previously discovered malware in November 2015, though the company claimed it did not impact guest databases. Sorenson acknowledged unauthorized network access since July 2014 but stated no guest data was accessed until mid-November 2018, when the breach was finally detected.
Marriott has provided the FBI with forensic data since October 2018 and reported no verified fraud linked to the breach. The company has since implemented enhanced security measures, including two-factor authentication and behavioral monitoring tools. At least five U.S. states and the UK’s Information Commissioner’s Office are investigating the incident.
The breach emerged after Marriott acquired Starwood in 2016 for $13.6 billion, a deal finalized a year after the hacking began. Senator Tom Carper questioned whether cybersecurity risks were adequately assessed during the merger, noting Starwood had faced prior security challenges.
Sorenson’s testimony followed revised estimates reducing the affected guest count from 500 million to 383 million. The Senate panel’s inquiry underscores growing scrutiny of corporate cybersecurity practices amid escalating digital threats.
