The U.S. Federal Trade Commission has finalized an order requiring Marriott International Inc. and its subsidiary Starwood Hotels & Resorts Worldwide LLC to implement a comprehensive information security program to settle charges following multiple hacks of the hotel group that led to the theft of details of 344 million customers globally.

The Federal Trade Commission (FTC) has responded to a series of massive Marriott and Starwood data breaches, ordering the

As a result, its estimated hackers had access to Marriott systems for up to four years, and these breaches landed the firm with a $52 million penalty by the FTC earlier this year, as the FTC argued the firm tried to hide the breaches, and “deceived consumers by claiming to have reasonable and appropriate data security.”

The Federal Trade Commission (FTC) has ordered Marriott International and Starwood Hotels to define and implement a robust customer data security scheme following failures that led to massive data breaches.