https://www.cnet.com/news/clues-to-marriott-data-breach-suggest-china-ties-report-says/

These clues suggest Chinese hackers could have orchestrated a campaign with the intention of harvesting data for Beijing's espionage efforts, said the unnamed sources, though someone else could also have launched the attack because some of the same hacking tools were made accessible online previously.

Given it's been four years since the hack was launched in 2014, investigators believe there may have been more than one hacking group inside Starwood's computer networks at the same time, making it harder to identify the culprit, added one of the sources.