The Marriott Hack: Why Hotel Networks Cannot Be Trusted With Your Data

In 2018, Marriott announced something that should have changed how every traveler thinks about hotel networks. Attackers had been inside the reservation system of its Starwood properties since 2014. Four years. They had access to the personal details of up to 500 million guests: names, addresses, passport numbers, payment card data. For four years, the systems of one of the world’s largest hotel companies were someone else’s playground, and nobody noticed.

I remember reading about it in an airport lounge, connected to the airport wifi, which tells you something about how seriously I took it at the time. Not seriously enough. It took a few more years, and a cybersecurity friend’s horrified expression, before I understood what the Marriott breach really meant for ordinary travelers. It was not just a story about a company’s failure. It was proof of a principle: hotel networks are where attackers go, because that is where the victims are.

This is that story, told as the cautionary tale it is, and what it means for how you use hotel wifi today.

What actually happened at Marriott

The breach began with Starwood, the hotel group behind Sheraton, Westin, and W Hotels, which Marriott acquired in 2016. Attackers had compromised Starwood’s guest reservation database back in 2014 and maintained access for years, including two full years after Marriott bought the company. When Marriott finally discovered the intrusion in late 2018, investigators found that the attackers had copied out vast quantities of guest data.

The numbers were staggering. Up to 500 million guest records were involved. For around 327 million of those, the exposed data included some combination of names, mailing addresses, phone numbers, email addresses, passport numbers, dates of birth, and reservation details. Millions of payment card numbers were also exposed, though Marriott said most were encrypted. Passport numbers are the detail that keeps security people up at night, because unlike a credit card, you cannot cancel a passport number and get a new one quickly.

Marriott faced enormous consequences: hundreds of millions in costs, a major fine from UK regulators, and years of lawsuits. But here is the part that matters for you as a traveler. The breach was discovered by accident, when an internal security tool flagged an unusual database query. For four years, everything looked normal. The hotels kept taking reservations, guests kept checking in, and the attackers kept collecting.

Why hotels are such attractive targets

Put yourself in the attacker’s shoes for a moment. Where would you go to find a concentrated supply of wealthy people with their defenses down? Hotels. Business executives, government officials, tourists with money, all connecting their devices to your network, all a little tired, a little distracted, all trusting the infrastructure because it has a familiar brand name on the building.

Hotel networks are also, frankly, easy. The industry runs on thin margins and high turnover, and IT security has rarely been a priority. Networks get installed by contractors, rarely updated, and managed by staff whose main job is hospitality, not cybersecurity. The wifi password is on a tent card in the lobby. The business center computers have not been patched since the last Olympics. It is, from a security perspective, a soft target wearing a luxury brand.

And the payoff is enormous. A single compromised hotel system yields not just wifi traffic but reservation databases full of passport numbers, corporate email addresses, travel patterns, and payment data. It is identity theft raw material at industrial scale. The Marriott attackers understood this perfectly. They were not after one guest. They were after all of them, for years.

What hotel networks expose about you

The reservation database is the company’s problem. The wifi network is yours. When you connect to hotel wifi, you are joining a shared network with every other guest, and depending on how it is set up, your traffic may be visible to anyone else on that network with modest technical skills and freely available tools.

What can they actually see? Anything you send unencrypted: which sites you visit, the contents of unencrypted messages, login credentials for services that do not encrypt properly. Even when your traffic is encrypted, an observer can often see which sites you are connecting to, just not what you are doing on them. That metadata alone is valuable. It tells an attacker which banks you use, which companies you work with, when you are active.

Then there are the active attacks. Fake wifi networks with names one letter off from the real one. Fake login pages that harvest your room number and name. The fake software update trick the FBI has warned about, where joining the network triggers a convincing prompt to install malware. None of these require the attacker to be sophisticated. They require the victims to be tired and trusting, which describes most hotel guests most of the time.

The uncomfortable truth about hotel wifi security today

You might assume things have improved since 2018. In some ways they have. More websites encrypt by default, which raises the floor. But the structural problems have not changed. Hotel wifi is still shared infrastructure built for convenience. The password is still on the tent card. The networks are still managed as an afterthought. And attackers still know that hotels concentrate exactly the people they want.

There have been other incidents since Marriott, smaller ones that did not make global headlines but followed the same pattern: hotel systems compromised, guest data harvested, discovered months later. The industry’s incentives have not changed either. Hotels compete on location, price, and thread count, not on network security. No guest has ever chosen a hotel because its wifi was properly segmented.

This is not an argument for never traveling. It is an argument for a realistic threat model. The hotel network is not your network. It is a stranger’s network that you are borrowing, in a building that has been breached before and will be breached again. Act accordingly.

What acting accordingly looks like

The practical steps are the same ones security professionals actually use on the road, because they work. First, encrypt everything before it touches the hotel network. Every byte leaving your device should be scrambled. This single step neutralizes the eavesdropping problem completely. Someone watching the network sees encrypted traffic going somewhere and learns nothing from it.

Second, verify the network name with the front desk and watch for lookalikes. The fake network attack is trivially easy to run and trivially easy to defeat if you spend ten seconds confirming.

Third, keep sensitive logins off raw hotel wifi entirely. If your encrypted connection is not running, do not open your bank. Wait. Nothing in your inbox is worth the risk.

Fourth, and this is the step most advice skips: think about where your encrypted traffic goes after it leaves the hotel. A commercial VPN encrypts you to a shared server, which solves the hotel problem but hands you the shared-address problem on the other end. Routing through your own home internet solves both at once. The hotel sees encrypted noise. The rest of the internet sees you at home.

That is the setup HomeIPVPN provides for travelers: hotel-proof encryption on the untrusted network, home identity on the other side. The Marriott breach happened on the hotel’s systems, but the lesson applies to the wifi too. Trust nothing you do not control.

A breach is a story. Make it someone else’s.

The Marriott hack is a story about a company, but the moral is personal. The attackers did not target anyone individually. They targeted the infrastructure everyone shared, and harvested everyone indiscriminately. That is how hotel network attacks work. You do not have to be important to be a victim. You just have to be connected.

Every time I check into a hotel now, I think about those four years. Four years of guests checking in, connecting to the wifi, living their lives, while someone quietly copied everything. They had no idea. There was nothing they could have seen that would have warned them. The only protection that would have worked was the kind you bring with you: encryption they could not read, and an internet identity that was not borrowed from a compromised network.

That is the problem HomeIPVPN was built to solve. If you would rather have someone set it up and verify it works, the Pre-Travel Audit & Advisory session is 1 hour, costs $79, and that fee comes straight off the $279 Secure Home IP VPN System session if you go ahead. You can book a Pre-Travel Audit & Advisory session and travel knowing the hotel’s network problems are the hotel’s, not yours.

The shampoo bottles are still fine. The wifi was never fine. Now you know.