The UK's data privacy watchdog has fined the Marriott Hotels chain £18.4m for a major data breach that may have affected up to 339 million guests, reports BBC.
The Information Commissioner's Office (ICO) said names, contact information, and passport details may all have been compromised in a cyber-attack.
The breach included seven million guest records for people in the UK.
The ICO said the company failed to put appropriate safeguards in place but acknowledged it had improved.
The first part of the cyber-attack happened in 2014, affecting the Starwood Hotels group, which was acquired by Marriott two years later.
But until 2018, when the problem was first noticed, the attacker continued to have access to all affected systems, including: names, email addresses, phone numbers, passport numbers, arrival and departure information, VIP status and
loyalty programme numbers.
On that basis, the ICO said Marriott had failed to protect personal data as required by the General Data Protection Regulation (GDPR).
"Millions of people's data was affected by Marriott's failure," commissioner Elizabeth Denham said.
"Thousands contacted a helpline and others may have had to take action to protect their personal data because the company they trusted it with had not."
Different types of data were exposed for different guests, and some of the estimated 339 million may have represented duplicate records for repeat guests, making an exact count impossible.
Despite imposing a fine, the ICO acknowledged that Marriott had acted quickly once it found the flaw, and had improved its systems since.
In a statement, Marriott wrote that it "deeply regrets the incident".
"Marriott remains committed to the privacy and security of its guests' information and continues to make significant investments in security measures for its systems.
"The ICO recognises the steps taken by Marriott following discovery of the incident to promptly inform and protect the interests of its guests," it said.