The employees worked for an affiliate of Marriott in Moscow.

This was the second of two major breaches announced by Marriott in recent years.

If partners, affiliates, or other third parties can access your records, you need to carefully limit their access using MFA, and/or closely monitor their activities to suspicious behavior.