There are reasons to be skeptical that the breach took place in 2014, rather than there were records in the data warehouse which could have been taken that dated to 2014.
Regardless of what did or didn’t happen, and whom to blame, we’re clearly not getting the full story from Marriott. And since it’s our very sensitive personal information they failed to safeguard, we should be demanding it.