Marriott International, Inc.; Analysis of Proposed Consent Order To Aid Public Comment, 82609-82611 [2024-23283]
Download as PDF
Federal Register / Vol. 89, No. 198 / Friday, October 11, 2024 / Notices
A. Federal Reserve Bank of St. Louis
(Holly A. Rieser, Senior Manager) P.O.
Box 442, St. Louis, Missouri 63166–
2034. Comments can also be sent
electronically to
Comments.applications@stls.frb.org:
1. The Gary Canada Family Trust and
the Bradley S. Canada 2020 Trust,
Bradley S. Canada, as trustee for both
Trusts, all of Little Rock, Arkansas; and
Gary R. Canada, Sr., England, Arkansas;
as a group acting in concert, to retain
voting shares of MHBC Investments
Limited Partnership I, LLLP, and
thereby indirectly retain voting shares of
Canada Bancshares, Inc., and the Bank
of England, all of England, Arkansas.
Board of Governors of the Federal Reserve
System.
Michele Taylor Fennell,
Associate Secretary of the Board.
[FR Doc. 2024–23634 Filed 10–10–24; 8:45 am]
BILLING CODE P
FEDERAL RESERVE SYSTEM
ddrumheller on DSK120RN23PROD with NOTICES1
Formations of, Acquisitions by, and
Mergers of Bank Holding Companies
The companies listed in this notice
have applied to the Board for approval,
pursuant to the Bank Holding Company
Act of 1956 (12 U.S.C. 1841 et seq.)
(BHC Act), Regulation Y (12 CFR part
225), and all other applicable statutes
and regulations to become a bank
holding company and/or to acquire the
assets or the ownership of, control of, or
the power to vote shares of a bank or
bank holding company and all of the
banks and nonbanking companies
owned by the bank holding company,
including the companies listed below.
The public portions of the
applications listed below, as well as
other related filings required by the
Board, if any, are available for
immediate inspection at the Federal
Reserve Bank(s) indicated below and at
the offices of the Board of Governors.
This information may also be obtained
on an expedited basis, upon request, by
contacting the appropriate Federal
Reserve Bank and from the Board’s
Freedom of Information Office at
https://www.federalreserve.gov/foia/
request.htm. Interested persons may
express their views in writing on the
standards enumerated in the BHC Act
(12 U.S.C. 1842(c)).
Comments received are subject to
public disclosure. In general, comments
received will be made available without
change and will not be modified to
remove personal or business
information including confidential,
contact, or other identifying
VerDate Sep<11>2014
17:15 Oct 10, 2024
Jkt 265001
information. Comments should not
include any information such as
confidential information that would not
be appropriate for public disclosure.
Comments regarding each of these
applications must be received at the
Reserve Bank indicated or the offices of
the Board of Governors, Ann E.
Misback, Secretary of the Board, 20th
Street and Constitution Avenue NW,
Washington DC 20551–0001, not later
than November 12, 2024.
A. Federal Reserve Bank of
Minneapolis (Mark Rauzi, Vice
President), 90 Hennepin Avenue,
Minneapolis, Minnesota 55480–0291.
Comments can also be sent
electronically to MA@mpls.frb.org:
1. Bravera Holdings Corp., Dickinson,
North Dakota; to acquire Vision Bank
Holdings, Inc., and thereby indirectly
acquire VISIONBank, both of Fargo,
North Dakota. In addition, Bravera
Acquisition Corp., Dickinson, North
Dakota, an interim subsidiary, to merge
with Vision Bank Holdings, Inc.,
whereby Bravera Acquisition Corp. will
be the surviving entity and a whollyowned subsidiary of Bravera Holdings
Corp. for a moment in time. Following
the interim holding company merger,
Bravera Acquisition Corp. will be
merged with and into Bravera Holdings
Corp., with Bravera Holdings Corp.
being the surviving entity.
Board of Governors of the Federal Reserve
System.
Michele Taylor Fennell,
Associate Secretary of the Board.
[FR Doc. 2024–23635 Filed 10–10–24; 8:45 am]
BILLING CODE P
FEDERAL RESERVE SYSTEM
Notice of Proposals To Engage in or
To Acquire Companies Engaged in
Permissible Nonbanking Activities
The companies listed in this notice
have given notice under section 4 of the
Bank Holding Company Act (12 U.S.C.
1843) (BHC Act) and Regulation Y, (12
CFR part 225) to engage de novo, or to
acquire or control voting securities or
assets of a company, including the
companies listed below, that engages
either directly or through a subsidiary or
other company, in a nonbanking activity
that is listed in § 225.28 of Regulation Y
(12 CFR 225.28) or that the Board has
determined by Order to be closely
related to banking and permissible for
bank holding companies. Unless
otherwise noted, these activities will be
conducted throughout the United States.
The public portions of the
applications listed below, as well as
other related filings required by the
PO 00000
Frm 00045
Fmt 4703
Sfmt 4703
82609
Board, if any, are available for
immediate inspection at the Federal
Reserve Bank(s) indicated below and at
the offices of the Board of Governors.
This information may also be obtained
on an expedited basis, upon request, by
contacting the appropriate Federal
Reserve Bank and from the Board’s
Freedom of Information Office at
https://www.federalreserve.gov/foia/
request.htm. Interested persons may
express their views in writing on the
question whether the proposal complies
with the standards of section 4 of the
BHC Act.
Comments received are subject to
public disclosure. In general, comments
received will be made available without
change and will not be modified to
remove personal or business
information including confidential,
contact, or other identifying
information. Comments should not
include any information such as
confidential information that would not
be appropriate for public disclosure.
Unless otherwise noted, comments
regarding the applications must be
received at the Reserve Bank indicated
or the offices of the Board of Governors,
Ann E. Misback, Secretary of the Board,
20th Street and Constitution Avenue
NW, Washington, DC 20551–0001, not
later than November 12, 2024.
A. Federal Reserve Bank of New York
(Bank Applications Officer) 33 Liberty
Street, New York, New York 10045–
0001. Comments can also be sent
electronically to
Comments.applications@ny.frb.org:
1. Grasshopper Bancorp, Inc., New
York, New York; through its subsidiary
bank, Grasshopper Bank, National
Association, also of New York, New
York, to acquire Auto Club Trust, FSB,
Dearborn, Michigan, and thereby engage
in operating a savings association
pursuant to section 225.28(b)(4)(ii) of
the Board’s Regulation Y.
Board of Governors of the Federal Reserve
System.
Michele Taylor Fennell,
Associate Secretary of the Board.
[FR Doc. 2024–23510 Filed 10–10–24; 8:45 am]
BILLING CODE P
FEDERAL TRADE COMMISSION
[File No. 192 3022]
Marriott International, Inc.; Analysis of
Proposed Consent Order To Aid Public
Comment
Federal Trade Commission.
Proposed consent agreement;
request for comment.
AGENCY:
ACTION:
E:\FR\FM\11OCN1.SGM
11OCN1
82610
Federal Register / Vol. 89, No. 198 / Friday, October 11, 2024 / Notices
The consent agreement in this
matter settles alleged violations of
Federal law prohibiting unfair or
deceptive acts or practices. The attached
Analysis of Proposed Consent Order to
Aid Public Comment describes both the
allegations in the complaint and the
terms of the consent order—embodied
in the consent agreement—that would
settle these allegations.
DATES: Comments must be received on
or before November 12, 2024.
ADDRESSES: Interested parties may file
comments online or on paper by
following the instructions in the
Request for Comment part of the
SUPPLEMENTARY INFORMATION section
below. Please write ‘‘Marriott and
Starwood; File No. 192 3022’’ on your
comment and file your comment online
at https://www.regulations.gov by
following the instructions on the webbased form. If you prefer to file your
comment on paper, please mail your
comment to the following address:
Federal Trade Commission, Office of the
Secretary, 600 Pennsylvania Avenue
NW, Mail Stop H–144 (Annex L),
Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT:
Katherine McCarron, Attorney, Division
of Privacy and Identity Protection,
Bureau of Consumer Protection, Federal
Trade Commission, 600 Pennsylvania
Avenue NW, Washington, DC 20580,
kmccarron@ftc.gov, (202–326–2333).
SUPPLEMENTARY INFORMATION: Pursuant
to section 6(f) of the Federal Trade
Commission Act, 15 U.S.C. 46(f), and
FTC Rule § 2.34, 16 CFR 2.34, notice is
hereby given that the above-captioned
consent agreement containing a consent
order to cease and desist, having been
filed with and accepted, subject to final
approval, by the Commission, has been
placed on the public record for a period
of 30 days. The following Analysis to
Aid Public Comment describes the
terms of the consent agreement and the
allegations in the complaint. An
electronic copy of the full text of the
consent agreement package can be
obtained at https://www.ftc.gov/newsevents/commission-actions.
You can file a comment online or on
paper. For the Commission to consider
your comment, we must receive it on or
before November 12, 2024. Write
‘‘Marriott and Starwood; File No. 192
3022’’ on your comment. Your
comment—including your name and
your State—will be placed on the public
record of this proceeding, including, to
the extent practicable, on the https://
www.regulations.gov website.
Because of heightened security
screening, postal mail addressed to the
Commission will be subject to delay. We
ddrumheller on DSK120RN23PROD with NOTICES1
SUMMARY:
VerDate Sep<11>2014
17:15 Oct 10, 2024
Jkt 265001
strongly encourage you to submit your
comments online through the https://
www.regulations.gov website. If you
prefer to file your comment on paper,
write ‘‘Marriott and Starwood; File No.
192 3022’’ on your comment and on the
envelope, and mail your comment to the
following address: Federal Trade
Commission, Office of the Secretary,
600 Pennsylvania Avenue NW, Mail
Stop H–144 (Annex L), Washington, DC
20580.
Because your comment will be placed
on the publicly accessible website at
https://www.regulations.gov, you are
solely responsible for making sure your
comment does not include any sensitive
or confidential information. In
particular, your comment should not
include sensitive personal information,
such as your or anyone else’s Social
Security number; date of birth; driver’s
license number or other State
identification number, or foreign
country equivalent; passport number;
financial account number; or credit or
debit card number. You are also solely
responsible for making sure your
comment does not include sensitive
health information, such as medical
records or other individually
identifiable health information. In
addition, your comment should not
include any ‘‘trade secret or any
commercial or financial information
which . . . is privileged or
confidential’’—as provided by section
6(f) of the FTC Act, 15 U.S.C. 46(f), and
FTC Rule § 4.10(a)(2), 16 CFR
4.10(a)(2)—including competitively
sensitive information such as costs,
sales statistics, inventories, formulas,
patterns, devices, manufacturing
processes, or customer names.
Comments containing material for
which confidential treatment is
requested must be filed in paper form,
must be clearly labeled ‘‘Confidential,’’
and must comply with FTC Rule
§ 4.9(c). In particular, the written
request for confidential treatment that
accompanies the comment must include
the factual and legal basis for the
request and must identify the specific
portions of the comment to be withheld
from the public record. See FTC Rule
§ 4.9(c). Your comment will be kept
confidential only if the General Counsel
grants your request in accordance with
the law and the public interest. Once
your comment has been posted on the
https://www.regulations.gov website—as
legally required by FTC Rule § 4.9(b)—
we cannot redact or remove your
comment from that website, unless you
submit a confidentiality request that
meets the requirements for such
treatment under FTC Rule § 4.9(c), and
the General Counsel grants that request.
PO 00000
Frm 00046
Fmt 4703
Sfmt 4703
Visit the FTC website at https://
www.ftc.gov to read this document and
the news release describing the
proposed settlement. The FTC Act and
other laws the Commission administers
permit the collection of public
comments to consider and use in this
proceeding, as appropriate. The
Commission will consider all timely
and responsive public comments it
receives on or before November 12,
2024. For information on the
Commission’s privacy policy, including
routine uses permitted by the Privacy
Act, see https://www.ftc.gov/siteinformation/privacy-policy.
Analysis of Proposed Consent Order To
Aid Public Comment
The Federal Trade Commission (the
‘‘Commission’’) has accepted, subject to
final approval, an agreement containing
consent order from Marriott
International, Inc. (‘‘Marriott’’) and
Starwood Hotels & Resorts Worldwide,
LLC (‘‘Starwood’’ or collectively,
‘‘Respondents’’). The proposed consent
order (‘‘Proposed Order’’) has been
placed on the public record for 30 days
for receipt of comments from interested
persons. Comments received during this
period will become part of the public
record. After 30 days, the Commission
will again review the agreement, along
with any comments received, and will
decide whether it should withdraw from
the agreement and take appropriate
action or make final the Proposed Order.
Marriott is a multinational hospitality
company that manages and franchises
hotels and related lodging facilities,
including 30 brands and more than
7,000 properties throughout the United
States and across 131 countries and
territories. On or about November 16,
2015, Marriott announced that it would
acquire Starwood, and on or about
September 23, 2016, Starwood became a
wholly owned subsidiary of Marriott.
With the acquisition of Starwood,
Marriott became the largest hotel chain
in the world at that time, with more
than 1.1 million hotel rooms,
accounting for one out of every fifteen
hotel rooms worldwide.
After Marriott’s acquisition of
Starwood, Marriott took control of
Starwood’s computer network and has
been responsible for establishing,
reviewing, and implementing the
information security practices for both
Marriott and Starwood. Additionally,
Marriott commenced a two-year process
to integrate some Starwood systems into
the Marriott network. Marriott fully
integrated those Starwood systems into
its own network by December 2018.
According to the FTC’s Complaint,
Respondents suffered at least three
E:\FR\FM\11OCN1.SGM
11OCN1
ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 89, No. 198 / Friday, October 11, 2024 / Notices
distinct data security breaches over the
course of several years. Starwood
informed customers of the first breach
just four days after the announcement of
Marriott’s acquisition of Starwood. This
breach allowed intruders to compromise
Starwood’s point-of-sale systems and
gain access to more than 40,000
customer payment cards over the course
of 14 months.
The second breach began on or
around July 28, 2014, and involved a
breach of a Starwood guest reservation
database. This breach went undetected
for four years—during which Marriott
had responsibility for Starwood’s
information security practices and
network following the acquisition.
Forensic examiners, retained by
Marriott in September 2018, identified
similar failures that resulted in the first
breach, including: inadequate firewall
controls, unencrypted payment card
information stored outside of the secure
cardholder data environment, lack of
multifactor authentication, and
inadequate monitoring and logging
practices. As a result of the second
breach, intruders compromised the
personal information of 339 million
Starwood guest records and 5.25 million
unencrypted passport numbers
worldwide. Additional compromised
information from the Starwood guest
reservation database included: names,
dates of birth, payment card numbers,
addresses, email addresses, telephone
numbers, usernames, Starwood loyalty
numbers, and partner loyalty program
numbers.
As to the third breach, Marriott
announced in March 2020 that
malicious actors had compromised the
credentials of employees at a Marriottfranchised property to gain access to
Marriott’s own network The intruders
began accessing and exporting
consumers’ personal information
without detection from September
2018—the same month that Marriott
became aware of the second breach—to
December 2018 and resumed in January
2020 and continued until they were
ultimately discovered in February 2020.
The intruders were able to access more
than 5.2 million guest records,
including 1.8 million records related to
U.S. consumers, that contained
significant amounts of personal
information, including: names, mailing
addresses, email addresses, phone
numbers, affiliated companies, gender,
month and day of birth, Marriott loyalty
account information, partner loyalty
program numbers, and hotel stay and
room preferences. Marriott’s internal
investigation confirmed that the
malicious actors’ main purpose for
searching, accessing, and exporting
VerDate Sep<11>2014
17:15 Oct 10, 2024
Jkt 265001
guest records was to identify loyalty
accounts with sufficient loyalty points
to be either used or redeemed, including
for booking stays at hotel properties.
The Commission’s proposed twocount complaint alleges that
Respondents violated section 5(a) of the
FTC Act by: (1) deceiving customers by
representing in each of their privacy
policies that they used reasonable and
appropriate safeguards to protect
consumers’ personal and financial
information; and (2) failing to employ
reasonable security measures to protect
consumers’ personal information. With
respect to these counts, the proposed
complaint alleges that Respondents:
• failed to implement appropriate
password controls, which resulted in
employees often using default, blank or
weak passwords;
• failed to patch outdated software
and systems in a timely manner;
• failed to adequately monitor and log
network environments, limiting the
ability to detect malicious actors and
distinguish between authorized and
unauthorized activity;
• failed to implement appropriate
access controls;
• failed to implement appropriate
firewall controls;
• failed to implement appropriate
network segmentation to prevent
attackers from moving freely across its
networks and databases; and
• failed to apply adequate multifactor
authentication to protect sensitive
information.
The proposed complaint alleges, with
respect to the second count above, that
Respondents’ failure to employ
reasonable security measures to protect
consumers’ personal information
caused, or is likely to cause, substantial
injury to consumers that is not
outweighed by countervailing benefits
to consumers or competition and is not
reasonably avoidable by consumers
themselves. Such practices constitute
unfair acts or practices under section 5
of the FTC Act.
The Proposed Order contains
injunctive relief designed to prevent
Respondents from engaging in the same
or similar acts or practices in the future.
Part I prohibits Respondents from
misrepresenting in any manner,
expressly or by implication: (1)
Respondents’ collection, maintenance,
use, deletion, or disclose consumers’
personal information; and (2) the extent
to which Respondents protect the
privacy, security, availability,
confidentiality, or integrity of
consumers’ personal information. Part II
requires that Respondents establish,
implement, and document a
comprehensive information security
PO 00000
Frm 00047
Fmt 4703
Sfmt 4703
82611
program. The program must include
specific safeguards tailored to
Respondents’ previous data security
shortcomings.
Parts III–VI require Respondents to
obtain initial and biennial information
security assessments by an independent,
third-party professional for 20 years
(part III), cooperate with the
independent assessor (part IV), provide
the Commission with a certification of
compliance with the Order from
Respondents’ CEO (part V), and submit
reports to the Commission if they suffer
additional data incidents (part VI).
Part VII requires Respondents to
provide a Clear and Conspicuous
method by which U.S. consumers can
request that Respondents review the
deletion of personal information
associated with an email address and/or
Loyalty Rewards Program account
number. Part VIII requires Respondents
to provide a link on their website and
mobile app where all U.S. consumers
may request deletion of Personal
Information associated with an email
address and/or Loyalty Rewards
Program account number.
Parts IX–XII are reporting and
compliance provisions, which include
recordkeeping requirements and
provisions requiring Respondents to
provide information or documents
necessary for the Commission to
monitor compliance. Part XIII states that
the Proposed Order will remain in effect
for 20 years, with certain exceptions.
The purpose of this analysis is to
facilitate public comment on the
Proposed Order, and it is not intended
to constitute an official interpretation of
the complaint or Proposed Order, or to
modify the Proposed Order’s terms in
any way.
By direction of the Commission,
Commissioners Holyoak and Ferguson
recused.
April J. Tabor,
Secretary.
[FR Doc. 2024–23283 Filed 10–10–24; 8:45 am]
BILLING CODE 6750–01–P
GENERAL SERVICES
ADMINISTRATION
[Notice—C0A–2024–01; Docket No. 2024–
0002; Sequence No 43]
Office of Human Resources
Management; SES Performance
Review Board
Office of Human Resources
Management (OHRM), General Services
Administration (GSA).
ACTION: Notice.
AGENCY:
E:\FR\FM\11OCN1.SGM
11OCN1
Agencies
[Federal Register Volume 89, Number 198 (Friday, October 11, 2024)]
[Notices]
[Pages 82609-82611]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-23283]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
[File No. 192 3022]
Marriott International, Inc.; Analysis of Proposed Consent Order
To Aid Public Comment
AGENCY: Federal Trade Commission.
ACTION: Proposed consent agreement; request for comment.
-----------------------------------------------------------------------
[[Page 82610]]
SUMMARY: The consent agreement in this matter settles alleged
violations of Federal law prohibiting unfair or deceptive acts or
practices. The attached Analysis of Proposed Consent Order to Aid
Public Comment describes both the allegations in the complaint and the
terms of the consent order--embodied in the consent agreement--that
would settle these allegations.
DATES: Comments must be received on or before November 12, 2024.
ADDRESSES: Interested parties may file comments online or on paper by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. Please write ``Marriott and
Starwood; File No. 192 3022'' on your comment and file your comment
online at https://www.regulations.gov by following the instructions on
the web-based form. If you prefer to file your comment on paper, please
mail your comment to the following address: Federal Trade Commission,
Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144
(Annex L), Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Katherine McCarron, Attorney, Division
of Privacy and Identity Protection, Bureau of Consumer Protection,
Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC
20580, [email protected], (202-326-2333).
SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec. 2.34, 16 CFR
2.34, notice is hereby given that the above-captioned consent agreement
containing a consent order to cease and desist, having been filed with
and accepted, subject to final approval, by the Commission, has been
placed on the public record for a period of 30 days. The following
Analysis to Aid Public Comment describes the terms of the consent
agreement and the allegations in the complaint. An electronic copy of
the full text of the consent agreement package can be obtained at
https://www.ftc.gov/news-events/commission-actions.
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or before November 12,
2024. Write ``Marriott and Starwood; File No. 192 3022'' on your
comment. Your comment--including your name and your State--will be
placed on the public record of this proceeding, including, to the
extent practicable, on the https://www.regulations.gov website.
Because of heightened security screening, postal mail addressed to
the Commission will be subject to delay. We strongly encourage you to
submit your comments online through the https://www.regulations.gov
website. If you prefer to file your comment on paper, write ``Marriott
and Starwood; File No. 192 3022'' on your comment and on the envelope,
and mail your comment to the following address: Federal Trade
Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Mail
Stop H-144 (Annex L), Washington, DC 20580.
Because your comment will be placed on the publicly accessible
website at https://www.regulations.gov, you are solely responsible for
making sure your comment does not include any sensitive or confidential
information. In particular, your comment should not include sensitive
personal information, such as your or anyone else's Social Security
number; date of birth; driver's license number or other State
identification number, or foreign country equivalent; passport number;
financial account number; or credit or debit card number. You are also
solely responsible for making sure your comment does not include
sensitive health information, such as medical records or other
individually identifiable health information. In addition, your comment
should not include any ``trade secret or any commercial or financial
information which . . . is privileged or confidential''--as provided by
section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive
information such as costs, sales statistics, inventories, formulas,
patterns, devices, manufacturing processes, or customer names.
Comments containing material for which confidential treatment is
requested must be filed in paper form, must be clearly labeled
``Confidential,'' and must comply with FTC Rule Sec. 4.9(c). In
particular, the written request for confidential treatment that
accompanies the comment must include the factual and legal basis for
the request and must identify the specific portions of the comment to
be withheld from the public record. See FTC Rule Sec. 4.9(c). Your
comment will be kept confidential only if the General Counsel grants
your request in accordance with the law and the public interest. Once
your comment has been posted on the https://www.regulations.gov
website--as legally required by FTC Rule Sec. 4.9(b)--we cannot redact
or remove your comment from that website, unless you submit a
confidentiality request that meets the requirements for such treatment
under FTC Rule Sec. 4.9(c), and the General Counsel grants that
request.
Visit the FTC website at https://www.ftc.gov to read this document
and the news release describing the proposed settlement. The FTC Act
and other laws the Commission administers permit the collection of
public comments to consider and use in this proceeding, as appropriate.
The Commission will consider all timely and responsive public comments
it receives on or before November 12, 2024. For information on the
Commission's privacy policy, including routine uses permitted by the
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.
Analysis of Proposed Consent Order To Aid Public Comment
The Federal Trade Commission (the ``Commission'') has accepted,
subject to final approval, an agreement containing consent order from
Marriott International, Inc. (``Marriott'') and Starwood Hotels &
Resorts Worldwide, LLC (``Starwood'' or collectively, ``Respondents'').
The proposed consent order (``Proposed Order'') has been placed on the
public record for 30 days for receipt of comments from interested
persons. Comments received during this period will become part of the
public record. After 30 days, the Commission will again review the
agreement, along with any comments received, and will decide whether it
should withdraw from the agreement and take appropriate action or make
final the Proposed Order.
Marriott is a multinational hospitality company that manages and
franchises hotels and related lodging facilities, including 30 brands
and more than 7,000 properties throughout the United States and across
131 countries and territories. On or about November 16, 2015, Marriott
announced that it would acquire Starwood, and on or about September 23,
2016, Starwood became a wholly owned subsidiary of Marriott. With the
acquisition of Starwood, Marriott became the largest hotel chain in the
world at that time, with more than 1.1 million hotel rooms, accounting
for one out of every fifteen hotel rooms worldwide.
After Marriott's acquisition of Starwood, Marriott took control of
Starwood's computer network and has been responsible for establishing,
reviewing, and implementing the information security practices for both
Marriott and Starwood. Additionally, Marriott commenced a two-year
process to integrate some Starwood systems into the Marriott network.
Marriott fully integrated those Starwood systems into its own network
by December 2018.
According to the FTC's Complaint, Respondents suffered at least
three
[[Page 82611]]
distinct data security breaches over the course of several years.
Starwood informed customers of the first breach just four days after
the announcement of Marriott's acquisition of Starwood. This breach
allowed intruders to compromise Starwood's point-of-sale systems and
gain access to more than 40,000 customer payment cards over the course
of 14 months.
The second breach began on or around July 28, 2014, and involved a
breach of a Starwood guest reservation database. This breach went
undetected for four years--during which Marriott had responsibility for
Starwood's information security practices and network following the
acquisition. Forensic examiners, retained by Marriott in September
2018, identified similar failures that resulted in the first breach,
including: inadequate firewall controls, unencrypted payment card
information stored outside of the secure cardholder data environment,
lack of multifactor authentication, and inadequate monitoring and
logging practices. As a result of the second breach, intruders
compromised the personal information of 339 million Starwood guest
records and 5.25 million unencrypted passport numbers worldwide.
Additional compromised information from the Starwood guest reservation
database included: names, dates of birth, payment card numbers,
addresses, email addresses, telephone numbers, usernames, Starwood
loyalty numbers, and partner loyalty program numbers.
As to the third breach, Marriott announced in March 2020 that
malicious actors had compromised the credentials of employees at a
Marriott-franchised property to gain access to Marriott's own network
The intruders began accessing and exporting consumers' personal
information without detection from September 2018--the same month that
Marriott became aware of the second breach--to December 2018 and
resumed in January 2020 and continued until they were ultimately
discovered in February 2020. The intruders were able to access more
than 5.2 million guest records, including 1.8 million records related
to U.S. consumers, that contained significant amounts of personal
information, including: names, mailing addresses, email addresses,
phone numbers, affiliated companies, gender, month and day of birth,
Marriott loyalty account information, partner loyalty program numbers,
and hotel stay and room preferences. Marriott's internal investigation
confirmed that the malicious actors' main purpose for searching,
accessing, and exporting guest records was to identify loyalty accounts
with sufficient loyalty points to be either used or redeemed, including
for booking stays at hotel properties.
The Commission's proposed two-count complaint alleges that
Respondents violated section 5(a) of the FTC Act by: (1) deceiving
customers by representing in each of their privacy policies that they
used reasonable and appropriate safeguards to protect consumers'
personal and financial information; and (2) failing to employ
reasonable security measures to protect consumers' personal
information. With respect to these counts, the proposed complaint
alleges that Respondents:
failed to implement appropriate password controls, which
resulted in employees often using default, blank or weak passwords;
failed to patch outdated software and systems in a timely
manner;
failed to adequately monitor and log network environments,
limiting the ability to detect malicious actors and distinguish between
authorized and unauthorized activity;
failed to implement appropriate access controls;
failed to implement appropriate firewall controls;
failed to implement appropriate network segmentation to
prevent attackers from moving freely across its networks and databases;
and
failed to apply adequate multifactor authentication to
protect sensitive information.
The proposed complaint alleges, with respect to the second count
above, that Respondents' failure to employ reasonable security measures
to protect consumers' personal information caused, or is likely to
cause, substantial injury to consumers that is not outweighed by
countervailing benefits to consumers or competition and is not
reasonably avoidable by consumers themselves. Such practices constitute
unfair acts or practices under section 5 of the FTC Act.
The Proposed Order contains injunctive relief designed to prevent
Respondents from engaging in the same or similar acts or practices in
the future. Part I prohibits Respondents from misrepresenting in any
manner, expressly or by implication: (1) Respondents' collection,
maintenance, use, deletion, or disclose consumers' personal
information; and (2) the extent to which Respondents protect the
privacy, security, availability, confidentiality, or integrity of
consumers' personal information. Part II requires that Respondents
establish, implement, and document a comprehensive information security
program. The program must include specific safeguards tailored to
Respondents' previous data security shortcomings.
Parts III-VI require Respondents to obtain initial and biennial
information security assessments by an independent, third-party
professional for 20 years (part III), cooperate with the independent
assessor (part IV), provide the Commission with a certification of
compliance with the Order from Respondents' CEO (part V), and submit
reports to the Commission if they suffer additional data incidents
(part VI).
Part VII requires Respondents to provide a Clear and Conspicuous
method by which U.S. consumers can request that Respondents review the
deletion of personal information associated with an email address and/
or Loyalty Rewards Program account number. Part VIII requires
Respondents to provide a link on their website and mobile app where all
U.S. consumers may request deletion of Personal Information associated
with an email address and/or Loyalty Rewards Program account number.
Parts IX-XII are reporting and compliance provisions, which include
recordkeeping requirements and provisions requiring Respondents to
provide information or documents necessary for the Commission to
monitor compliance. Part XIII states that the Proposed Order will
remain in effect for 20 years, with certain exceptions.
The purpose of this analysis is to facilitate public comment on the
Proposed Order, and it is not intended to constitute an official
interpretation of the complaint or Proposed Order, or to modify the
Proposed Order's terms in any way.
By direction of the Commission, Commissioners Holyoak and
Ferguson recused.
April J. Tabor,
Secretary.
[FR Doc. 2024-23283 Filed 10-10-24; 8:45 am]
BILLING CODE 6750-01-P