Management Information System: A Case Study on Marriott's Data Breach

This report presents a case study on Marriott International's data breach, analyzing the challenges and impacts of the security failure on its management information systems (MIS). The report begins with a brief overview of Marriott International, highlighting its global presence and operational structure. It then delves into the 2018 data breach, detailing the challenges faced, including compromised customer and employee data, DDoS attacks, financial losses, and risks to trade secrets. The study examines the role of information systems in the breach, emphasizing the vulnerability of unencrypted data and the impact of malware. The conclusion underscores the significance of MIS in business efficiency and the critical need for robust cybersecurity measures to protect sensitive data. The report highlights the importance of encryption and proactive security protocols to prevent future breaches and mitigate potential damages to the organization's reputation and financial stability. The report also emphasizes on the impact of the data breach on customer trust and the financial implications faced by the organization.

Running head: MANAGEMENT INFORMATION SYSTEM
Management Information System: Marriott International
Name of the Student
Name of the University
Author’s Note:

1
MANAGEMENT INFORMATION SYSTEM
Table of Contents
1. Introduction............................................................................................................................2
2. Discussion..............................................................................................................................2
2.1 Brief Description of the Organization..............................................................................2
2.2 Challenges or Issues faced by the Organization in their Information Systems................3
2.3 Impact of Information Systems on the Data Breach........................................................6
3. Conclusion..............................................................................................................................7
References..................................................................................................................................9

2
MANAGEMENT INFORMATION SYSTEM
1. Introduction
MIS or management information system is a computer-based system that includes
different types of hardware as well as software, which could serve as a subsequent backbone
for several distinct business operations (Romanosky, Hoffman and Acquisti 2014). This MIS
even gathers sensitive data from every online system, analyses information before reporting
the data to execute decision making process. The following report outlines a brief discussion
on the case study of Marriott Hotel that has faced issue of data breach for their information
systems. They have been focusing on different aspects of data security, however due to such
data breach, they were unable to secure their information system and almost 500 million
users have lost the data. The major challenges or issues faced by the company and the impact
of information systems on the business will be provided in this report for Marriott
International Hotel.
2. Discussion
2.1 Brief Description of the Organization
Marriott International is one of the most popular and significant multi-national
expanded hospitality company in America that has the responsibility to manage as well as
franchise a broad portfolio of different similar companies. It was founded by Willard Marriott
in the year of 1927 and it is referred to as the third largest hotel chain in world. Marriott
International consists of 30 brands with around seven thousand properties within more than
131 territories and countries in the world. The total revenue of this popular hotel chain was
20.75 billion US dollars and that of operating income was 2.36 billion US dollars in the year
of 2018. More than 176000 employees are working in the organization and they have been
serving their clients for several years in the most unique manner.

3
MANAGEMENT INFORMATION SYSTEM
They have always focused on the effective services that are provide to their customers
and for this purpose, security is kept on top priority. In spite of having such distinctive
advantages and high security, Marriott International has faced one of the biggest and the most
significant data scandal in the year of 2018 that caused high risk and damage for the
customers, employees and the respective organizational contractors. Although, they have
used encryption technique within their information system, the password reset option was
being eliminated completely and thus high risk has prevailed. The description of the risk and
the major impact and role of information system for this particular issue is provided in the
following paragraphs.
2.2 Challenges or Issues faced by the Organization in their Information Systems
Marriott International Hotel, being one of the most significant and important hotels in
the world, has always ensured that the data, which is being entered is accurate and effective.
As a result, the services of the hotel has always been on top position, as compared to any
other hotels or similar hospitality organizations (Sen and Borle 2015). During November of
the year 2018, the higher management level of this particular organization has announced that
the cyber criminals have stolen or hacked the confidential data for more than 500 million
hotel clients. This specific data security breach eventually took place on the information
systems that supported the hotel brands of Starwood, which initiated during 2014.
The respective cyber attackers had remained in their system only after Starwood was
being acquired by Marriott in 2016 and was not eventually discovered until 2018 September.
For few of their victims, only contact information and names were compromised. These
cyber attackers even remained within the system only after Marriott had taken Starwood
(Marriott CEO Reveals New Details About Mega Breach. 2018). They had the core ability of
taking few of the distinct combination of passport numbers, travel information, preferred
guest list and numbers of Starwood contact information and several others. Marriott

4
MANAGEMENT INFORMATION SYSTEM
International subsequently believed that the numbers and expiration dates of around one
hundred million customers’ credit cards were being stolen, and the organization was
completely uncertain if the cyber criminals had the capability of decryption of numbers of
credit cards.
After proper analysis, it was being observed that a Chinese Intelligence group was the
seeker into this issue and gathered data for the US citizens according to an article in the New
York Times (Marriott CEO Reveals New Details About Mega Breach. 2018). The major
effect had occurred on the information system and due to the lack of high security in these
information systems within Starwood, the cyber attackers got a chance to get into the systems
and bring out such distinct issues and complexities to a high level. Although, management
information system is responsible to reduce major complexities for better information
management, it even provides ways to involve high data security risks and threats within that
particular organization (Manworren, Letwat and Daily 2016). The major challenges or issues
faced by Marriott International due to such threat in information systems are provided in the
following paragraphs:
i) Compromising Customers’ Data: The first challenge that is being faced by Marriott
International for data breach is compromise in the customers’ data. The confidential data of
more than 500 million customers were being compromised and every significant detail, such
as contact information, names, addresses were being eventually stolen by the cyber attackers
and it has brought major issues in the organization (Peters 2014). Moreover, the
consequences are extremely vulnerable and could be significant in dealing with the sensitive
information.
ii) Putting Employees’ Data at Risk: The second important and significant challenge
that is being faced by Marriott International for data breach is putting the data of the

5
MANAGEMENT INFORMATION SYSTEM
employees at high risk (Trautman and Ormerod 2016). The behaviour of the employees could
eventually comprise of a high impact on the data security within the business. As a result,
apart from 500 million customers, the confidential data of the employees are also at risk and
it could have a major impact on data security. Sensitive information regarding employees
within the organization is as valuable as the data of the customers and hence processes and
policies of security should be extremely stringent for both the information of employees and
customers (Ablon et al. 2016).
iii) Suffering a DDoS Attack: Another important and noteworthy challenge that is
being faced by Marriott International for data breach is suffering a DDoS attack. Such attacks
could be termed as the distinct types of malicious attacks, which take down specific network
resources and machines (Shu et al. 2017). It is done by indefinite and temporary disruption of
services of a host connected to the Internet connection with several superfluous requests.
Marriott International even has faced few of the most significant financial consequences. Due
to the DDoS attack, the respective network and information systems were made completely
unavailable for the customers and they even could have distinct issue in maintenance of data
and other operations. After acquiring Starwood, Marriott International has even focused on
the details of the different computerized system without much complexity (Cease 2014).
iv) High Financial Loss: This is the next significant and noteworthy issue that is
eventually faced by the organization of Marriott International Hotel in their business. The
majority of cyber-attacks majorly concentrate on the financial data and details and the
cybercrime damages and loss of financial data and finances to a high extent. Since, Marriott
International Hotel has faced issues related to loss of customer data, it is evident that the rest
of the customers would not consider Marriott Hotel as their first priority and the major issue
of customer loss is prevailed within their subsequent business (Sharkey 2016). They have
created a new vision and have identified each and every reason for which such impacts have

6
MANAGEMENT INFORMATION SYSTEM
occurred. As a result, they have found out that due to the complexities and lack of security
within information systems, they were unable to stop the data breach under any circumstance.
Moreover, they were even unable to find out the issue for 2 years and thus such financial
losses have prevailed in the business.
v) Risks to Trade Secrets and Intellectual Properties: Another distinct and important
issue that is being faced in the organization of Marriott International Hotel for their data
breach in the information system is the major risk to various trade secrets as well as
intellectual properties (Janakiraman, Lim and Rishika 2018). Due to the breach in the
information system, they were unable to save their intellectual properties to a high level and
such issue has even leaked their trade secrets, which are extremely vulnerable for the
organization. They were targeted by the hackers and in spite of presence of encryption in
their information systems, the passwords in these information systems were not upgraded
properly (Sarabi et al. 2016). The password security was required to be increased to a high
level.
vi) Suffering Damaging Downtime: They have even faced issues related to damages
in down time. They have spent a lot of money and time after ensuring that they are remaining
visible and also comprising of a positive perception online (Chassang 2017). Whenever they
were being targeted by the cyber criminals, who have utilized sophisticated systems for
execution of data attacks, the respective effort and time is worthless.
2.3 Impact of Information Systems on the Data Breach
Any type of informational roles could be effectively achieved by incorporating
information system within a business. A major emphasis is being placed on the information
with a definite boundary and the users, processors, inputs, outputs and storage of various
communication networks is properly evaluated without any kind of complexity (Spiekermann

7
MANAGEMENT INFORMATION SYSTEM
et al. 2015). Information system comprises of an important aim for providing support to
operations, decision-making procedure and proper management and it even helps in
controlling the overall performance of several business processes. The main purpose of an
information system is improvised decision-making after providing updated and even accurate
data for different organizational assets such as personnel, inventories, marketing, financial
and finally raw materials. This type of IS ca collect the confidential data, store it and even
make it available and accessible to the managers, who analyses the data. The information
systems of Marriott International Hotel had major impact on the data breach (Martin, Borah
and Palmatier 2017). Information that was being accessed by the hackers mainly included
payment information, mail addresses, passport numbers and names of the customers.
The management of Marriott was unable to understand the breach in the first phase of
data and as soon as it was being contacted by a software company, it managed the Starwood’s
guest-reservation database. Hence, three hundred and eight three million guest records as well
as more than eighteen million encrypted passport numbers were being breached (Marriott
CEO Reveals New Details About Mega Breach. 2018). The information system of this
particular organization of Marriott International Hotel played one of the most important and
significant roles in this data breach. China was identified as the main source of hacking and
they got into the information systems of this hotel and thus more than five million
unencrypted passport numbers were being hacked. The management of Marriott International
Hotel even agreed to the point that the passport numbers and other confidential details of the
customers were not encrypted and as a result, the confidential data was hacked eventually
(Voss 2016). The malware identified in the IT systems of Starwood was RAT or Remote
Access Trojan that allowed the hackers in covertly accessing, surveying as well as gaining
control on the computer systems.

8
MANAGEMENT INFORMATION SYSTEM
3. Conclusion
Hence, conclusion can be drawn that information system plays one of the major and
the most significant roles in managing overall effectiveness and efficiency of a business. It is
being used by a company in such a manner that individuals can easily interact with the
technology after supporting different business processes. It is a working system, in which the
activities are being devoted for capturing, transmission and storage of information. Proper
decision making, coordination, control, visualization and analysis of information within a
company. In spite of having such distinctive advantages, a popular organization, Marriott
International Hotel has faced data breach in their business for an issue in their existing
information system. The above report has clearly outlined a detailed analysis of the case
study of Marriott International Hotel and their data breach as well as impact of information
system on this challenge faced by them.

9
MANAGEMENT INFORMATION SYSTEM
References
Ablon, L., Heaton, P., Lavery, D.C. and Romanosky, S., 2016. Consumer attitudes toward
data breach notifications and loss of personal information. Rand Corporation.
Cease, C.C., 2014. Giving Out Your Number: A Look at the Current State of Data Breach
Litigation. Ala. L. Rev., 66, p.395.
Chassang, G., 2017. The impact of the EU general data protection regulation on scientific
research. ecancermedicalscience, 11.
Janakiraman, R., Lim, J.H. and Rishika, R., 2018. The effect of a data breach announcement
on customer behavior: Evidence from a multichannel retailer. Journal of Marketing, 82(2),
pp.85-105.
Manworren, N., Letwat, J. and Daily, O., 2016. Why you should care about the Target data
breach. Business Horizons, 59(3), pp.257-266.
Marriott CEO Reveals New Details About Mega Breach. 2018. [online]. Accessed from
https://www.forbes.com/sites/kateoflahertyuk/2019/03/11/marriott-ceo-reveals-new-details-
about-mega-breach/ [Accessed on 01 October 2019].
Martin, K.D., Borah, A. and Palmatier, R.W., 2017. Data privacy: Effects on customer and
firm performance. Journal of Marketing, 81(1), pp.36-58.
Peters, R.M., 2014. So you've been notified, now what: The problem with current data-breach
notification laws. Ariz. L. Rev., 56, p.1171.
Romanosky, S., Hoffman, D. and Acquisti, A., 2014. Empirical analysis of data breach
litigation. Journal of Empirical Legal Studies, 11(1), pp.74-104.

10
MANAGEMENT INFORMATION SYSTEM
Sarabi, A., Naghizadeh, P., Liu, Y. and Liu, M., 2016. Risky business: Fine-grained data
breach prediction using business profiles. Journal of Cybersecurity, 2(1), pp.15-28.
Sen, R. and Borle, S., 2015. Estimating the contextual risk of data breach: An empirical
approach. Journal of Management Information Systems, 32(2), pp.314-341.
Sharkey, C.M., 2016. Can Data Breach Claims Survive the Economic Loss Rule. DePaul L.
Rev., 66, p.339.
Shu, X., Tian, K., Ciambrone, A. and Yao, D., 2017. Breaking the target: An analysis of
target data breach and lessons learned. arXiv preprint arXiv:1701.04940.
Spiekermann, S., Acquisti, A., Böhme, R. and Hui, K.L., 2015. The challenges of personal
data markets and privacy. Electronic markets, 25(2), pp.161-167.
Trautman, L.J. and Ormerod, P.C., 2016. Corporate Directors' and Officers' Cybersecurity
Standard of Care: The Yahoo Data Breach. Am. UL Rev., 66, p.1231.
Voss, W.G., 2016. European union data privacy law reform: General data protection
regulation, privacy shield, and the right to delisting. Business Lawyer, 72(1), pp.221-233.