Marriott Class Action Says Hotel Waited Too Long To Inform Canadians of Data Breach

A Canadian class action lawsuit accuses Marriott International Inc. of not doing enough to prevent or respond to a data breach that occurred in the systems of one of the companies it owns, Starwood.

Plaintiff Oi-Man Birnbaum says Marriott waited too long to tell the public about the data breach, and into doing, put Canadian customers at risk for identity theft and fraud.

According to Birnbaum, the data breach in question occurred in 2014. Allegedly, Starwood’s website became infected with an SQL injection bug, and “offers to hack the site were being made on the dark web.” 

Allegedly, Marriott International acquired Starwood on or around Sept. 23, 2016, but announced its plans to do so on Nov. 15, 2015. 

The Canada Marriott data breach class action lawsuit says that days later, Starwood warned Marriott that some of Starwood’s point-of-sale cash registers had been affected by malware designed to steal personal information from customers. 

In 2015, Starwood allegedly conducted an investigation into the malware attack, examining its Guest Database in the process.

The company then reportedly sent a letters to its customers on Nov. 20, 2015 and Jan. 22, 2016, to inform customers that the database had not been compromised.

According to Birnbaum, the merger of Starwood and Marriott combined the loyalty programs of both companies. The Marriott data breach class action lawsuit goes on to say that on Sept. 8, 2018, Marriott was alerted that there had been an attempted breach of Starwood’s guest reservation database in the United States.

The Marriott Starwood Canada data breach says that at that time, Marriott learned that the unauthorized access had started in 2014.

Birnbaum goes on to recount that Marriott informed the public about the data breach on or around Nov. 30, 2018. Allegedly, the company announced that personal information of as many as 500 million customers had been accessed, making the data breach the second largest in history. 

The Marriott class action states that the information compromised in the data breach included passport numbers, travel histories, loyalty program accounts, and credit card information.

Birnbaum’s Marriott data breach class action lawsuit says that the same breach affected not just Starwood’s system, but the Marriott portal. Allegedly, the breach also resulted in the theft of gift card and hotel stay points. 

The Canada Marriott class action claims that the company waited more than 80 days to tell the public about the breach, which put customers at risk for identity theft.

Allegedly, the company prohibited customers from taking action to protect their information during this time period, putting them at a higher risk for financial injury than necessary.

Have you had personal information compromised in a data breach? Let us know your story in the comments below.

Birnbaum is represented by Clint Docken of Guardian Law Group LLP and James Brown of James H. Brown & Associates. 

The Canada Marriott Starwood Data Breach Class Action Lawsuit is Oi-Man Birnbaum v. Marriott International Inc., Case No. 1909-05981, in the Court of Queen’s Bench of Alberta, Calgary.

Read More Lawsuit & Settlement News:

Marriott Class Action Alleges Drip Pricing Scheme

Is Uloric Safer than Allopurinol?

Hilton, Hyatt, Marriott Class Action Alleges Hotel Pricing Conspiracy

New Lawsuit Filed Over Unfair Unum Long Term Disability Denial