If they make no attempt to improve their security I suspect the next incident will cost them $800m. Be interesting to see who will insure them against that.
When the parent comment said "they could set up an insurance fund", I believe they didn't mean a literal contract with an insurance company, but a straight up savings fund set up by Marriott to be used in the future specifically for expenses like that.
The board should be planning some proper security. A £50m capital budget and £5m a year revenue should be good enough.