Marriott Bought a Hotel Chain. It Also Bought a Breach That Had Already Been Running for Two Years.

In September 2016, Marriott International closed one of the largest hotel acquisitions in history, absorbing Starwood Hotels & Resorts and, with it, eleven new brands, hundreds of thousands of employees, and a reservation system that had been quietly compromised by an unknown intruder since 2014 — two full years before Marriott ever signed the deal. Nobody involved in the acquisition knew it at the time. The breach sat there, undiscovered, through the entire due diligence process, through the deal closing, and through nearly two more years of Marriott running Starwood's legacy IT infrastructure largely as-is. Full technical integration of an acquisition that size takes time, and Starwood's reservation system was one of the pieces Marriott hadn't gotten around to replacing yet.

Marriott finally discovered the intrusion in September 2018, when an internal security tool flagged unusual database activity. By the time the investigation wrapped, the numbers were staggering: roughly 500 million guest records exposed, including passport numbers for 327 million individuals, spanning reservation data that had been sitting on that legacy system the entire time.

The UK's Information Commissioner's Office (ICO) opened an investigation, initially signaling an intent to fine Marriott £99.2 million — later adjusted to £18.4 million after representations, but still one of the largest GDPR enforcement actions of its era. And the regulator's reasoning is the single most important detail in this entire story: the ICO wasn't primarily punishing Marriott for what happened on Starwood's watch before the acquisition. It was punishing Marriott for what happened after the deal closed — specifically, for continuing to run legacy Starwood infrastructure without adequately assessing what was on it, securing it, or replacing it, for roughly two years after inheriting it.

The Two Kinds of Legacy Risk Hiding Inside Every Acquisition

It's worth separating this problem into two distinct risks, because they get treated as one issue in most standard M&A playbooks, even though they operate on completely different timelines.

Both risks point at the same underlying gap: M&A due diligence and post-merger integration planning are built around financial models, legal structure, culture, and synergy milestones. Data disposition — figuring out what old systems and hardware need to be sanitized, verified, or destroyed — sits at the very bottom of the checklist, if it appears at all.

Why This Gap Survives Even at Careful, Well-Run Companies

It would be easy to read the Marriott case as a story about corporate carelessness. It isn't. Marriott is a sophisticated, well-resourced global enterprise. The gap didn't come from indifference — it came from the structural mismatch between how M&A timelines work and how deep technical security audits must go.

Due diligence occurs under intense time constraints and confidentiality restrictions. A buyer cannot dispatch a team to audit every server rack or employee laptop closet before signing. Consequently, true technical reality only emerges after the ink is dry — precisely when leadership attention pivots to organizational restructuring, brand consolidation, and customer retention. Decommissioning legacy servers becomes an item for "Phase Two," and in many companies, Phase Two never actually arrives.

The Compliance Layer Doesn't Pause for Integration Timelines

Global data privacy regulators have made it clear: they do not grade on a curve for corporate complexity. Under GDPR Article 5(1)(f) (integrity and confidentiality) and Article 32 (security of processing), an organization is held strictly accountable for any data it retains, regardless of whether that data was collected organically or absorbed through a corporate acquisition closed eighteen months earlier.

This pattern is not isolated to hospitality. The 2022 merger bringing Change Healthcare into UnitedHealth Group's ecosystem was followed by a catastrophic ransomware event affecting over 100 million individuals, in an environment where complex, multi-entity legacy IT integrations formed the backdrop. Frameworks like the HIPAA Security Rule,FTC Safeguards Rule, and banking regulations enforce the exact same standard: there is no regulatory exemption for "we are still integrating."

The Divestiture Mirror Image: Transition Services Agreements (TSAs)

The same vulnerability emerges in reverse when an organization spins off a subsidiary or sells a business division. Divestitures typically rely on Transition Services Agreements (TSAs), where the seller provides shared IT infrastructure for 6 to 24 months while the buyer builds independent capacity.

This in-between period is where severe compliance cracks form:

• Temporary shared servers get extended indefinitely past original contract deadlines.
• Customer records of the divested unit linger on physical drives retained by the parent company.
• Neither party can definitively prove who holds custody of historical data or whether residual backups were sanitized.

When a data incident occurs during or after a TSA period, "the transition was still underway" does not satisfy regulatory inquiries. A TSA without verified, tamper-proof erasure records is simply an open invitation to litigation.

What an M&A Data Disposition Program Actually Requires

To eliminate the legacy system erasure gap permanently, forward-thinking enterprises deploy a structured 7-pillar framework:

The Key Takeaway

The core lesson of the Marriott breach is not that M&A is inherently perilous or that due diligence must be infinite. The lesson is simpler and more operational: regulatory accountability does not pause while you integrate. Every day an unassessed legacy server stays connected, legal liability compounds.

Every corporate deal brings home more than financial balance sheets and intellectual property. It brings home someone else's old servers, outdated endpoints, and untracked databases. Organizations that avoid becoming headline case studies are those that pair deal closing with an automated, verified data erasure pipeline.