[coldcode]

Pays to read the original article, it wasn't Marriott it was the company they bought, long before the purchase. Marriott's system was not compromised.

[mannykannot]

Be that as it may, Marriott now owns it - literally. Just before this news broke, there was evidence of disarray in one or both company's systems in the kerfuffle over the awards system. https://news.ycombinator.com/item?id=18558876

It might be a case of years of technical debt coming due with a vengeance. I wonder if the technical people of either party to the acquisition were aware of the size of the problem beforehand, and if so, what they said about it and how it was received.

[PakG1]

I wonder how much IT security will start to play into due diligence efforts in acquisitions in the future. It seems there's an inordinate amount of risk exposure in security matters. Then again, I think Equifax is still a healthy company financially, so maybe not.

[tomatotomato37]

That is exactly what due diligence is for. At the very least the potential of this happening should have been priced into the final purchasing cost

[wavefunction]

When they bought that company it became their system. You can't just hand wave away PCI compliance hehe.

[WillPostForFood]

It just might be a more accurate if it was something like, “Marriott bought itself a security nightmare with the Starwood acquisition.” It is certainly Marriott’s problem to deal with now, but there security team might not be as bad as Starwood’s.