Some US intelligence officials believe that the breach was conducted to enrich the massive Chinese data sets on US and other citizens that have been amassed for years, the people said.
Such breaches include the 2015 Office of Personnel Management intrusion, which compromised the personal data of more than 20 million government employees, family members and applicants, and also information collected during Chinese breaches of health care institutions such as Anthem and CareFirst.
The FBI and other intelligence agencies declined to comment.
The New York Times first reported that investigators believe the attackers likely were from a Chinese state intelligence service.
The Marriott breach exposed an unusually broad array of data, including names, addresses, phone numbers, passport numbers and credit card numbers, as well as information on where people traveled and with whom.
Such information would be valuable not just to criminals seeking to commit identity fraud but also intelligence agencies seeking to build dossiers and track movements of diplomats, spies, military personnel, business executives and journalists, according to several cybersecurity experts.
Armed with a rich array of personal data, an intelligence agency can also tailor an approach to a person to see if the individual can be recruited as a spy or blackmailed for information.
The passport data, which is not often collected in data breaches, likely was a particularly valuable find for the hackers.
The people familiar with the investigation said the Marriott breach involved the same cloud hosting space as Chinese state hackers have used in the past, and that one signature technique that involved hopping among servers also points to Chinese involvement.
Another clue suggesting nation-state involvement was that none of the breached data has appeared on the "dark web" or any of the forums that criminals typically use to sell stolen credentials and other valuable personal data.
"If it were a criminal act, people would be trying to sell it," said one of the people familiar with the investigation.
The breach of the reservation system for Marriott's Starwood subsidiaries was one of the largest in history, affecting travelers at hotel chains St. Regis, Westin, Sheraton, Aloft, Le Meridien, Four Points and W Hotels from 2014 onward, according to a Marriott news release last month.
Marriott acquired Starwood in 2016 and kept the reservation databases separate from its own until recently. The reservation system of Marriott hotels themselves, based in Bethesda, Maryland, were not affected by the breach. The company has more than 6,700 properties around the world.
An internal security tool flagged the possible breach beginning on Sept. 8 and later discovered the hackers had accessed customer information and attempted to remove it in encrypted form, the company said. Marriott was able to decrypt the information and understand the extent of the breach only in November, it said.
Marriott on Tuesday reiterated its previous comment on the data breach, saying in a statement: "Our primary objectives in this investigation are figuring out what occurred and how we can best help our guests. We have no information about the cause of this incident, and we have not speculated about the identity of the attacker."
China's foreign ministry declined to comment Wednesday. But a spokesman last week said that "China firmly opposes all forms of cyber attack and cracks down on it in accordance with the law."
"If offered evidence, the relevant Chinese departments will carry out investigations according to the law. We firmly object to making groundless accusations on the issue of cyber security," spokesman Geng Shuang said at a press briefing when asked about the Marriott allegations.
News of the breach prompted several US government officials to announce investigations, including New York Attorney General Barbara Underwood, Maryland Attorney General Brian Frosh and Pennsylvania Attorney General Josh Shapiro. Several members of Congress also publicly demanded answers.
Privacy advocates long have warned that travel data can provide remarkably precise insights into the lifestyles, tastes and personal relationships of individuals, but the industry has lagged behind others, such as banking, in securing information against hackers.
