11 Marriott Data Breach Class Action Lawsuits Consolidated into MDL

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Eleven class action lawsuits lodged after the announcement of the massive Marriott data breach in late 2018 will be consolidated into multidistrict litigation and head to Maryland.

The massive data breach affecting Marriott’s Starwood reservation system as far back as 2014 was announced in November 2018.

Marriott International disclosed that it had lost the personal information of up to 500 million customers to hackers. In addition to names, addresses, and phone numbers, the hotel had also reportedly exposed the passport information and travel dates of certain hotel guests.

Multiple class action lawsuits were launched after the announcement and both Marriott and the plaintiffs agreed to centralize the litigation at a hearing with the Judicial Panel on Multidistrict Litigation. Lawsuits cropped up in various states, including California, Illinois, New York, and Massachusetts.

The Panel agreed that consolidating the class action lawsuits into multidistrict litigation (MDL) was the best option, also noting that Marriott was headquartered in Maryland and most witnesses would be found in the area.

“[W]e find that centralization…of all actions in the District of Maryland will serve the convenience of the parties and witnesses and promote the just and efficient conduct of this litigation,” noted the Panel’s decision.

“Ten of these actions—which are putative nationwide and/or statewide consumer class actions—share factual issues concerning a recently-disclosed breach of Marriott’s Starwood guest reservation database from 2014 to 2018,” explained the Panel’s order in the Marriott data breach MDL.

“The factual overlap among these actions is substantial, as they all arise from the same data breach, and they all allege that Marriott failed to put in to place reasonable data protections. Many also allege that Marriott did not timely notify the public of the data breach.”

One Marriott data breach class action lawsuit was brought on behalf of stockholders and alleged that the hotel chain misled investors regarding the breach, leading to a drop in stock prices. The parties in this class action lawsuit argued that it would not be appropriate to consolidate their claims into the MDL.

The Panel disagreed, however, noting “We find sufficient factual overlap among the actions to warrant including [the stock price class action lawsuit claims] in centralized proceedings and that its inclusion will not impose a significant burden on the transferee judge.”

The Marriot data breach reportedly affected hotels using the Starwood reservation system, including W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton, Design Hotels, and Starwood branded timeshare properties.

The hotel reported that it learned of the data breach in September 2018, but did not announce it to consumers until November of that year. Further, Marriott did not purchase the Starwood reservation system until 2016 – two years after the breach reportedly began.

The Marriott Data Breach MDL is In re: Marriott International Inc. Customer Data Security Breach Litigation, Case No. 2879, in the U.S. Judicial Panel on Multidistrict Litigation.

UPDATE: On Feb. 21, 2020, a federal judge found that Marriott must face a multidistrict litigation filed by consumers who claim that the hotel chain should have done more to protect them from one of the biggest data breaches in history.