Orbitz Class Action Lawsuit Filed Over Data Breach

Online travel reservation companies Orbitz LLC and Orbitz Worldwide Inc. are facing a class action lawsuit alleging their failure to adequately safeguard consumer information left sensitive data vulnerable to a data breach that was announced earlier this month.

According to the Orbitz class action lawsuit, the data breach affected consumers who used Orbitz.com from Jan. 1, 2016 through Dec. 22, 2017 to make reservations for flights, hotels and/or other travel services.

The Orbitz defendants are a subsidiary of Expedia, which is also named as a defendant in the data breach class action lawsuit.

“The security breach compromised hotel customers’ full name, credit and debit card account numbers, card expiration dates, card verification codes, email, phone number, address, and other private identifiable information (‘PII’),” plaintiff Tim Dupler says in the Orbitz data breach class action lawsuit.

Dupler claims that, as a result of the Orbitz data breach, the putative Class Members have had their privacy rights violated and are now at an increased risk of fraud and identity theft.

“It is well known, and the subject of many media reports, that PII is highly coveted and a frequent target of hackers,” the Orbitz data breach class action lawsuit states. “Despite well-publicized litigation and frequent public announcements of data breaches, Defendants and [their] affiliates opted to maintain an insufficient and inadequate system to protect the PII of Plaintiffs and Class Members.”

Dupler points to data from the Department of Justice’s Bureau of Justice Statistics which indicates that victims of identity theft may spend more than a year resolving issues related to the breach. To complicated matters, he notes, there is often a lag time between the date the PII is stolen and the date the PII is used.

The U.S. Government Accountability Office conducted a study of data breaches and found that stolen data may be held for more than a year before it is used to commit identity theft. Further, if the data is posted on the web, use of the stolen data may continue for years.

“Plaintiff and Class Members now face years of constant surveillance of their financial and personal records, monitoring, and loss of rights,” Dupler says in the Orbitz class action lawsuit.

Dupler filed the Orbitz class action lawsuit on behalf of himself and a proposed Class of U.S. residents who made a reservation or booking on Orbitz.com between Jan. 1, 2016 and Dec. 22, 2017. He also seeks to represent a Class of California residents who made a reservation or booking through Orbitz.com during the same time period.

The Orbitz data breach class action lawsuit asserts claims for breach of implied contract, negligence, violation of California’s Unfair Competition Law, unfair and deceptive business practices, constitutional invasion of privacy (on behalf of the California Class), negligence per se, breach of the covenant of duty of good faith and fair dealing, and violation of state data breach acts.

Dupler is represented by Bobby Saadian of Wilshire Law Firm.

The Orbitz Data Breach Class Action Lawsuit is Tim Dupler v. Orbitz LLC, et al., Case No. 2:18-cv-02303, in the U.S. District Court for the Central District of California.