University Research Project: Marriott Data Breach and Business Impact

This research project, focusing on the Marriott data breach, investigates the business problem of compromised customer data, and explores the critical importance of cybersecurity for major hotel brands. The project delves into the context of the breach, which exposed the personal information of millions of customers due to a security lapse. It outlines the research questions, such as why cybersecurity is crucial for hotel competitiveness, and sets the objective to identify its significance. The project includes a literature review, examining scholarly articles that discuss the impact of data breaches on businesses, the importance of data protection technologies, and the legal and financial consequences of cyberattacks. It also highlights the need for robust regulatory systems, employee monitoring, and proactive measures like regular security audits and encryption. The research emphasizes the growing sophistication of cybercriminals and the need for travel and hospitality firms to comply with data protection rules, such as GDPR, to maintain consumer trust and protect their brand reputation. The project underscores the financial and reputational damage data breaches can inflict, advocating for improved data privacy systems, cyber-training, and a comprehensive understanding of data protection regulations to mitigate risks and ensure long-term business viability. The Marriott data breach serves as a case study to understand the far-reaching consequences of data breaches in the hospitality industry.

Running head: DATA BREACH
Assessment 2: Research Project (Part 1):
[An Investigation on a Business Problem]
Name of the student:
Name of the university:
Author note:

1DATA BREACH
Table of Contents
Section 1: The Business Problem and Research Objectives......................................................2
Research Context:..................................................................................................................2
Business Problem:..................................................................................................................3
Research Questions:...............................................................................................................4
Research Objectives:..............................................................................................................4
Section 2: Literature Search and Review...................................................................................4
Literature Gap:.......................................................................................................................8
References..................................................................................................................................9

2DATA BREACH
Section 1: The Business Problem and Research Objectives
Research Context:
Marriott confirmed that on Friday hackers have illegally accessed the reservation
systems for as long as four years. Such a breach of data is first of its kinds ever experienced
by Marriott. It uncovered private details of up to 500 million clients while underscoring the
touchy idea of records demonstrating where and when individuals travel -and with whom.
The breach of the booking system for Marriott's Starwood subsidiaries was one of the biggest
of its kinds ever. After two record-setting Yahoo hacks and was especially upsetting for the
idea of the information that was stolen, security specialists said. That incorporates
commonplace data, for example, names, addresses, charge card numbers and telephone
numbers and furthermore rarer prizes for hackers, for example, international passport
numbers, travel areas and entry and takeoff dates (Washingtonpost.com, 2019). The potential
estimation of such data on such an enormous level of the world's travelers triggered a fact
that Marriott may have or possible has been the objective of country state hackers. These
hackers are trying to follow the movements of representatives, spies, military authorities and
business administrators. However, regardless of whether the hackers were simple offenders
looking for the benefit, such information had possibly offered crude material. This was for a
scope of potential offenses including data fraud (Washingtonpost.com, 2019).
Marriott International and the Federal Trade Commission (FTC) should take a very
serious look at the issue. This is undeniably a massive breach of data leading to millions of
customers’ data stolen by hackers. There is no guarantee that such instances will not be
repeated in the future. It is noteworthy that despite publishing a news release to address the
issue Marriott's image is being affected. Rumors are arising on the incapability of the security
system in Marriott to protect a wide range of customers' data. Hence, it can be assumed that

3DATA BREACH
by not controlling such problems from happening Marriott’s market reputation will be
affected. This fact validates the significance of undertaking research work on "the Marriott
data breach".
Business Problem:
The breach of data in such a way is a problematic condition for Marriott as well as for
its customers. Marriott will be in question for their security excellence, which they apply to
protect their guests' data. On the other hand, customers will feel less secure with their data.
They may develop perceptions like are intentionally surrendering their data in the hand of an
unsecured service provider.
An internal security team in the Marriott traced unauthorized access to millions of
data by an unauthorized party. According to the internal security team at Marriott, such
incidents have happened earlier as well. It was 8th of September when Hackers had illegally
accessed to millions of data. They encrypted it to access. It took Marriott almost two months
to decrypt it back. The data was decrypted back until late November (Washingtonpost.com,
2019). This is not the first time the case of a data breach has happened. Indeed, such instances
are in continuation for the last four years. It appears as if the higher security officials could
not effectively utilize previous opportunities.
Marriott has already addressed the issues through a news release soon after the
incident took place. They acknowledged a failure in encryption security. In the news release,
officials of Marriott explained their data protection system to keep their customers' trust alive
on the brand (Washingtonpost.com, 2019). However, there was no comment made on
whether the pieces of information such as names, addresses, email addresses, phone numbers
and passport numbers are also protected in Marriott (Washingtonpost.com, 2019).

4DATA BREACH
Research Questions:
Why is cybersecurity so important for the competitiveness of major hotel brands?
Research Objectives:
To identify the importance of cybersecurity in the competitiveness of major hotel
brands
Section 2: Literature Search and Review
This section takes help of various relevant scholarly articles to find answers on the
identified research question.
According to Gillespie (2019), technologies used to protect customers’ data are
potential ways to ensure a good service offered to customers. These technologies help to
access a vast quantity of data and to offer excellent service to customers. However, this is
also undeniable that it provides a huge opportunity to cybercriminals to illegally access huge
volumes of valuable personal data. It is important that service providers are aware of the
importance to protect customers’ data. The risk of data breach needs to be reduced regularly
to attain enhanced competitiveness.
As observed by Lavorgna & Sergi (2016) cybersecurity has been one of the top
concerns of the government organizations and the banking sector. Nevertheless, the
hospitality and tourism sector has started acknowledging the importance to reduce the threat
of data breach. The hospitality and travel sector is more concerned with online security to

5DATA BREACH
improve its users' experience in their day-to-day operations. Despite this growing urgency,
the instances of cybercrime are growing as well.
In the opinion of Magliulo (2016), hospitality service providers become vulnerable to
adverse consequences when they meet with data breaches. A data breach will lead them to
face significant legal, financial and reputational losses. Also, they could witness a loss of
customer trust in their services. The legal cost of a data breach could be painful as well. This
will affect the profit and loss sheet, and will eventually affect the company’s annual
performance.
Major Chain of hotel brands as according to Kansakar, Munir & Shabani (2019)
should pay utmost attention to protecting sensitive data. There is an increasing need to
maintain the privacy, security and integrity of all those pieces of information, which are in
their care. There is a growing need to implement a robust and responsive user rights
management hierarchy. Such a management hierarchy is required to deal systematically with
data braches cases. The article suggests that employees should also be closely monitored to
identify any signs of access abuse.
As stated by Lusthaus & Varese (2017) the existing regulatory system to safeguard
customers’ data has proved ineffective in numerous instances. Major hotel brands have faced
data breaches problems. Until and unless there is any improvement in the regulatory system,
hotel brands will have no clarity about the data protection law. Hence, they may develop
reduced faith in the country's governing structure concerning safeguard customers' data.
Travel and hospitality firms as believed by Reitano, Oerting & Hunter (2015) should
comply with data protection rules and policies to avoid huge financial penalization for data
breaches. Indeed, service firms are indirectly responsible for instances of data breaches for
using huge customers' data and not being able to offer robust security to these valuable data.

6DATA BREACH
It is noteworthy that the effect of data breaches will be realized along with several business
functional divisions such as the company’s legal, IT and marketing structure.
Akhgar & Brewster (2016) suggest several ways to travel and hospitality firms to be
able to protect customers' data. This includes but not limited to regular audits to check the
security effectiveness, watertight password control and increased encryption of data. The
article suggests that these initiatives are no longer ignorable. Indeed, hospitality firms should
show utmost eagerness to practice this suggested list of initiatives. Marketing campaigns
should be following compliance and privacy policies. Moreover, all teams should be briefed
on ways to handle data breach in case they have an opportunity to do so. By effectively
protecting customers' data, travel and hospitality firms would not just meet regulatory
obligations but will also increase consumer confidence in them. Moreover, this will
strengthen its global brand reputation
According to Martin, Borah & Palmatier (2017), data breach cases affect the financial
capacity of a firm due to the immediate cost implications involved in making compensation
and providing protection to those who are the sufferers in data breach cases. The cost
implications will also involve the payment of fines and the cost of fixing the problem.
Therefore, the article indicates a huge financial loss to the firm that has met a data breach
problem. If such things persist and a firm stays in a state of vulnerability to data breaches, the
firm will experience longer-term financial consequences. This will also cause economic
damage to the business. This may even undermine the industry it operates in.
In the opinion of Tcherni et al. (2016), cybercriminals are growing in their power.
They are to carry and perform ever-increasing cyber-attacks. The cybercriminal industry is
becoming more complex with times and is expanding in regards to its network with its
operators based all over the world. The industry is constantly growing with no signs of

7DATA BREACH
stoppage to it in any possible form. The cybercriminal industry is so dense and is complicated
that it becomes difficult to identify people who are involved in cybercriminal activity. The
group can also have people from within the firm itself. It is due to the fact important to erase
the records of those who have left their previous employer. If not, the market reputation of
the travel and hospitality firm could be at stake.
According to Ngo & Jaishankar (2017), once the data breach has happened and the
data has been stolen, this will lead to adverse consequences. The lost data can be used for
multiple wrongdoings such as persistent criminality, and can also explore the business to
extortion and blackmail. It is noteworthy that a data breach or data hack is not a one-off
event. Rather, it can repeatedly happen over times. Indeed, the existing crime protection
policy, rules and procedures are more effective in arresting conventional criminals rather than
cybercriminals.
As stated by Aiken et al. (2016), personal data security is increasingly becoming a
challenge for travelers and service users. Some countries have excellent data protection laws
such as those belonging to the European Union whereas many other countries do not have
equally effective laws and governance. In spite of having a robust policy structure, few
companies are failing to comply with EU’s new data protection laws.
According to Keyser (2017), businesses in the European Union region will have to
comply with the General Data Protection Regulation (GDPR). Firms will have to invest in
training people on how to generate skills needed to comply with the GDPR policies. Data
privacy system needs to become much more effective in controlling data breach cases. If not,
the management team will be questionable to the legal structure of the state it belongs to and
the European Union.

8DATA BREACH
Porcedda (2018) as a minimum effort the directors of major hotel brands will have to
ensure their business remains compliant with the General Data Protection Regulation
(GDPR). To be able to do so there is a need for constant monitoring of systems and processes
that can help to run the business following the guidelines of GDPR. Major hotel firms can go
to establishing a privacy committee to improve their performance with data privacy
objectives. There is a need to establish an effective linkage of the data privacy objectives with
that to the directors’ performance management.
As observed by e Silva (2018), there is a need for the management team to understand
the key elements of the General Data Protection Regulation (GDPR). There should be an
awareness of the impact of GDPR on the stored data. Major hotel brands in particular need to
know about the readiness assessment of GDPR. The management team should ask one
question to themselves every single moment like whether they have all the information
needed to discourage any data breach. There is a need to ensure that whether these brands
have an appropriate action plan to fight with data breach and have specific recommendations
such as cyber-training programs to improve the system. These questions are not ignorable for
any hotel and tourism service provider that commits to safeguard their customers’ valuable
data.
Literature Gap:
This study has used relevant and quality scholarly articles to find answers to the
research question. The study was able to validate the fact that cybersecurity is important for
the competitiveness of major hotel brands. It validates the fact with useful information
obtained from various scholarly articles. However, it fails to address areas such as what
elements of an organization are a major fault in terms of not being able to control the data
breach cases.

9DATA BREACH
References
Aiken, M., Mc Mahon, C., Haughton, C., O'Neill, L., & O'Carroll, E. (2016). A consideration
of the social impact of cybercrime: examples from hacking, piracy, and child abuse
material online. Contemporary Social Science, 11(4), 373-391.
Akhgar, B., & Brewster, B. (Eds.). (2016). Combatting cybercrime and cyberterrorism:
challenges, trends and priorities. Springer.
e Silva, K. K. (2018). Vigilantism and cooperative criminal justice: is there a place for
cybersecurity vigilantes in cybercrime fighting?. International Review of Law,
Computers & Technology, 32(1), 21-36.
Gillespie, A. A. (2019). Cybercrime: key issues and debates. Routledge.
Kansakar, P., Munir, A., & Shabani, N. (2019). Technology in the Hospitality Industry:
Prospects and Challenges. IEEE Consumer Electronics Magazine, 8(3), 60-65.
Keyser, M. (2017). The Council of Europe Convention on Cybercrime. In Computer
Crime (pp. 131-170). Routledge.
Lavorgna, A., & Sergi, A. (2016). Serious, therefore organised? A critique of the emerging"
cyber-organised crime" rhetoric in the United Kingdom. International Journal of
Cyber Criminology, 10(2), 170-187.
Lusthaus, J., & Varese, F. (2017). Offline and local: The hidden face of cybercrime. Policing:
A Journal of Policy and Practice.
Magliulo, A. (2016). Cyber security and tourism competitiveness. European Journal of
Tourism, Hospitality and Recreation, 7(2), 128-134.

10DATA BREACH
Martin, K. D., Borah, A., & Palmatier, R. W. (2017). Data privacy: Effects on customer and
firm performance. Journal of Marketing, 81(1), 36-58.
Ngo, F., & Jaishankar, K. (2017). Commemorating a Decade in Existence of the International
Journal of Cyber Criminology: A Research Agenda to Advance the Scholarship on
Cyber Crime. International Journal of Cyber Criminology, 11(1).
Porcedda, M. G. (2018). Patching the patchwork: appraising the EU regulatory framework on
cyber security breaches. Computer law & security review, 34(5), 1077-1098.
Reitano, T., Oerting, T., & Hunter, M. (2015). Innovations in international cooperation to
counter cybercrime: The joint cybercrime action taskforce. The European Review of
Organised Crime, 2(2), 142-154.
Tcherni, M., Davies, A., Lopes, G., & Lizotte, A. (2016). The dark figure of online property
crime: Is cyberspace hiding a crime wave?. Justice Quarterly, 33(5), 890-911.
Washingtonpost.com (2019). [online] Available at:
https://www.washingtonpost.com/business/2018/11/30/marriott-discloses-massive-
data-breach-impacting-million-guests/?noredirect=on&utm_term=.ecfaa9f9a778
[Accessed 21 Jul. 2019].