The Federal Trade Commission has ordered Marriott International and its subsidiary Starwood Hotels & Resorts Worldwide to implement a "comprehensive information security program" after the hotel giant suffered three major data breaches from 2014 to 2020 that exposed the personal information of 344 million customers worldwide.

In a separate settlement announced Wednesday, this one with all 50 state attorneys general, Marriott agreed to pay $52 million in penalties in connection with two of the breaches, which ran from 2014 to 2018 and exposed 131 million Starwood guest records.