Marriott / Starwood (2014-2018)

Hackers — later attributed to Chinese state-sponsored group APT41 — maintained access to Starwood's reservation system for four years, exfiltrating 500 million guest records including passport numbers, travel itineraries, and encrypted payment data. The breach was discovered only after Marriott completed its $13.6 billion Starwood acquisition in 2018.