Marriott International (2018)

Hackers lurked inside Marriott’s Starwood reservation system for four years, eventually stealing 500 million guest records including passport numbers and payment details. While this dwarfs the National Public Data leak in per-record sensitivity — passport data is uniquely damaging — it amounts to 83% fewer total records than the 2.9 billion-event. The breach triggered a £18.4 million fine under GDPR and forced Marriott to overhaul its global cybersecurity infrastructure.