“The FTC’s complaint alleges that Marriott failed to implement appropriate password controls, firewall controls, or network segmentation.”
Three breaches between 2014 and 2020 hit more than 334 million customers. Marriott pays $52 million split across 49 states and DC. That works out to about 16 cents a guest. No multifactor authentication, no patching, no segmentation, and the punishment is a security program it should have had a decade ago.