You'd think by now that hotel chains would have learned that (a) they really need to do a thorough annual audit of their own security and (b) do the same in spades for any business they're thinking of buying.
Obviously they haven't. It's going to take a few more big fines and lawsuits, big enough for the board and investors to notice. Even then it seems doubtful that they'll manage to learn from the misfortunes of others.