Marriott / Starwood (2014-2018)

Hackers attributed to Chinese state-sponsored group APT41 maintained access to Starwood's reservation system for four years, exfiltrating 500 million guest records including passport numbers and encrypted payment data before Marriott's $13.6 billion acquisition in 2018. The duration of this attack outperforms #7's timeline by nearly double, as most breaches are detected within weeks. The sheer volume of stolen data — 500 million records — is 40% larger than the runner-up's total on this list. The breach highlights the risks of delayed detection in complex corporate integrations.