Marriott International Repeated Data Breach Class Action

Marriott International faces one of the largest consumer data breach class actions in history after disclosing in November 2018 that hackers had infiltrated its Starwood guest reservation database for approximately four years—since 2014—undetected. The breach exposed the personal records of up to 500 million guests, including names, mailing addresses, phone numbers, email addresses, passport numbers, dates of birth, gender, arrival and departure information, and in some cases encrypted payment card details. Plaintiffs allege Marriott was grossly negligent in failing to detect the intrusion after its 2016 acquisition of Starwood Hotels & Resorts, during which it inherited the compromised network without performing adequate cybersecurity due diligence.

The litigation was further complicated when Marriott disclosed a second, separate breach in March 2020 affecting approximately 5.2 million additional guests whose loyalty program data was accessed using employee credentials. The consolidated MDL proceeding in Maryland addresses both incidents, with plaintiffs asserting claims for negligence, breach of implied contract, unjust enrichment, and violations of numerous state consumer protection and data security statutes. Marriott also faces an £18.4 million fine from the UK's Information Commissioner's Office. The case underscores persistent concerns about cybersecurity practices in the hospitality industry and the risks consumers face when corporations fail to safeguard sensitive travel and identification data.