Marriott International has agreed to pay $52 million and make changes to bolster its data security to resolve state and federal claims related to major data breaches that affected more than 300

The U.S. Federal Trade Commission said on Wednesday it will require Marriott International and its subsidiary Starwood Hotels & Resorts Worldwide to put in place an information security program to settle charges over multiple data breaches from 2014 to 2020.

Marriott Hotels will pay a $52 million penalty to Oregon and 49 other states to settle allegations that it failed to detect a gaping vulnerability in its Starwood database from 2016 to 2018, which allowed hackers to access 131.5 million customers files, including 1.6 million booking records in Oregon.