Marriott data breach highlights basic failings