Marriott Reaches $52 Million Settlement for Data Breach with multi-State Coalition

National News (10/10/2024) – Maryland Attorney General Anthony G. Brown announced yesterday that Marriott International, Inc. has agreed to a $52 million multistate settlement related to a significant data breach of its guest reservation database. The breach, which impacted over 131 million individuals, occurred between 2014 and 2018 and exposed a wide range of personal data, including contact information, birth dates, and some unencrypted passport numbers and payment card details. Maryland will receive $2.2 million of the total settlement.

This agreement, which was co-led by Maryland and other states, resolves allegations that Marriott failed to implement adequate security measures following its acquisition of Starwood Hotels & Resorts in 2016. The breach was undetected for four years, during which time hackers accessed sensitive data across the Starwood and Marriott systems. Investigators concluded that Marriott misrepresented its data security practices, which contributed to violations of Maryland’s Consumer Protection Act and Personal Information Protection Act.

Attorney General Brown emphasized the importance of safeguarding consumer information: “Marylanders should not have to choose between staying in a hotel and protecting their privacy. Consumers should be able to trust that companies will take reasonable steps to protect their personal information.”

In addition to the financial settlement, Marriott has committed to improving its cybersecurity measures significantly. These measures include the implementation of a comprehensive Information Security Program, incorporating zero-trust principles, and requiring regular reporting to senior leadership. Marriott will also minimize the amount of data it collects and retain consumer data for shorter periods. Furthermore, the company will be subject to an external review of its security practices every two years for the next 20 years.

Consumers affected by the breach will have new protections under the settlement, including the ability to request data deletion and multi-factor authentication for loyalty program accounts such as Marriott Bonvoy. These measures aim to ensure that Marriott’s future operations are more secure, and that guests can confidently trust the company to protect their personal information.

The multistate investigation, coordinated by multiple attorneys general offices, was led by Maryland, Connecticut, Oregon, and several other states, and involved cooperation with the Federal Trade Commission, which also reached a parallel settlement with Marriott.

Story by multiple RFHC contributors

[wtpsw_carousel]