Loading
Hospitality
11 min read
Areas of Expertise :
Data Breach, Data Security, Cybersecurity, Digital Forensics, Economic Damages
Published Date:
Last Modified Date:
Jurisdiction:
Federal. Fourth Circuit
The Marriott data breach lawsuit stemmed from unauthorized access to Starwood’s guest reservation database, which Marriott acquired in 2016. Marriott disclosed the breach on November 30, 2018, after determining that unauthorized actors had accessed the Starwood reservation database. The company first reported that information for up to approximately 500 million guests may have been involved.
On January 4, 2019, Marriott revised the estimate to about 383 million records as an upper limit, while stating that this did not mean 383 million unique guests were affected. Marriott also reported approximately 5.25 million unencrypted passport numbers, about 20.3 million encrypted passport numbers, and about 8.6 million encrypted payment cards.
Later FTC materials described the main Starwood reservation breach as beginning around July 2014 and remaining undetected until September 2018. The FTC stated that malicious actors accessed about 339 million Starwood guest account records worldwide, including 5.25 million unencrypted passport numbers. The information at issue included names, mailing addresses, email addresses, phone numbers, dates of birth, loyalty information, reservation information, passport information, and some payment card information.
The federal consumer cases were centralized as In re Marriott International, Inc., Customer Data Security Breach Litigation, MDL No. 19-md-2879, in the U.S. District Court for the District of Maryland before Judge Paul W. Grimm. Plaintiffs alleged negligence, breach of contract, and violations of state consumer-protection and privacy statutes. The MDL addressed Marriott’s data-security practices, Starwood’s legacy systems, cybersecurity diligence during and after the Starwood acquisition, and claimed consumer losses tied to the breach.
Marriott announced that unauthorized actors had accessed the Starwood guest reservation database, which became part of Marriott after the 2016 Starwood acquisition. The company initially reported that up to approximately 500 million guests could have been affected. The disclosed information included names, mailing addresses, email addresses, phone numbers, birth dates, reservation details, passport numbers, and some payment card information. Marriott later revised the affected-record estimate to about 383 million records as an upper limit, not 383 million unique guests.
The Judicial Panel on Multidistrict Litigation centralized the federal lawsuits in the U.S. District Court for the District of Maryland as MDL No. 19-md-2879. The litigation was assigned to Judge Paul W. Grimm. The centralized actions involved overlapping allegations about Marriott’s cybersecurity practices, the Starwood reservation system, alleged consumer injury, and state privacy and consumer-protection claims.
During class-certification discovery, plaintiffs served the initial Rule 26 expert report of economist Dr. Jeffrey T. Prince on July 12, 2021. Dr. Prince was deposed on August 13, 2021. Defendants Marriott and Accenture served the expert report of economist Dr. Catherine E. Tucker on September 7, 2021, and Dr. Tucker was deposed on September 29, 2021. After disputes arose over Dr. Prince’s rebuttal opinions and testimony, Judge Grimm allowed Dr. Tucker to provide a supplemental report, which was filed on February 18, 2022.
Judge Grimm granted class certification in part and denied it in part. The court certified three Rule 23(b)(3) damages classes for Maryland, New York, and California claims, and four Rule 23(c)(4) issue classes tied to Florida, Maryland, Connecticut, and Georgia negligence-related issues. The court denied certification of the Michigan ITPA damages class, denied without prejudice classes relying on a loss-of-market-value theory, and denied without prejudice a class for injunctive or declaratory relief.
That same day, Judge Grimm issued a companion Daubert ruling addressing expert admissibility. Plaintiffs relied on Dr. Prince for classwide damages opinions concerning alleged overpayment and the claimed market value of compromised personal information. Marriott and Accenture relied on Dr. Tucker to challenge whether those alleged harms and damages could be measured through common proof. The court denied the defense motion to exclude Dr. Prince’s overpayment model for class-certification purposes, but granted the motion to exclude his model for calculating the market value of compromised personal information.
The class-certification record also cited plaintiffs’ data-security expert Mary Frantz. Her report was discussed as part of plaintiffs’ common evidence on duty and breach issues tied to Marriott’s data-security practices.
In the related City of Chicago enforcement track, the District of Maryland issued a memorandum opinion addressing Marriott’s Daubert motion, Rule 12(b)(1) motion, and summary-judgment motion. The opinion focused on Chicago’s claims under a local consumer-protection ordinance, including standing, monetary fines, home-rule authority, and extraterritoriality arguments. The court denied Marriott’s Daubert motion, granted in part and denied in part Marriott’s Rule 12(b)(1) motion, and denied Marriott’s summary-judgment motion.
The Fourth Circuit vacated the initial class-certification order and remanded the case. The appellate court held that the district court should have considered the effect of class-action waivers in the Starwood Preferred Guest contracts before certifying damages classes against Marriott. The Fourth Circuit also stated that the issue classes against Accenture depended in part on the damages classes against Marriott.
After remand, the district court again granted class certification. Judge Grimm concluded that Marriott could not rely on the class-action waiver because, in the district court’s view, Marriott had waived that defense through its conduct in the MDL. This ruling later became the subject of the 2025 Fourth Circuit appeal in Maldini v. Marriott International, Inc.
On October 9, 2024, Marriott reached a $52 million multistate settlement with 49 states and the District of Columbia. That same day, the FTC announced a proposed order involving Marriott and Starwood. On December 20, 2024, the FTC finalized an order requiring Marriott and Starwood to implement a comprehensive information-security program, limit data retention, provide a way for U.S. customers to request deletion of certain personal information, review loyalty accounts on request, and restore stolen loyalty points when appropriate.
In Maldini v. Marriott International, Inc., Nos. 24-1064 and 24-1065, the Fourth Circuit reversed the district court’s recertification order. The court held that Marriott did not waive its right to rely on the Starwood Preferred Guest class-action waiver and that the waiver was valid and enforceable. The Fourth Circuit reversed certification of all classes against Marriott and also reversed the issue classes against Accenture because those classes had been justified in connection with the Marriott damages classes. The ruling did not decide the merits of individual consumer claims.
Court:
United States District Court for the District of Maryland
Case Name:
In re Marriott International, Inc., Customer Data Security Breach Litigation
Information Security
Computer Security
Online Privacy
Consumer Protection
Class Certification
Damage Analysis
Economic Analysis
Hotel Due Diligence
The Marriott data breach lawsuit stemmed from unauthorized access to Starwood’s guest reservation database, which Marriott acquired in 2016. Marriott disclosed the breach on November 30, 2018, after determining that unauthorized actors had accessed the Starwood reservation database. The company first reported that information for up to approximately 500 million guests may have been involved.
On January 4, 2019, Marriott revised the estimate to about 383 million records as an upper limit, while stating that this did not mean 383 million unique guests were affected. Marriott also reported approximately 5.25 million unencrypted passport numbers, about 20.3 million encrypted passport numbers, and about 8.6 million encrypted payment cards.
Later FTC materials described the main Starwood reservation breach as beginning around July 2014 and remaining undetected until September 2018. The FTC stated that malicious actors accessed about 339 million Starwood guest account records worldwide, including 5.25 million unencrypted passport numbers. The information at issue included names, mailing addresses, email addresses, phone numbers, dates of birth, loyalty information, reservation information, passport information, and some payment card information.
The federal consumer cases were centralized as In re Marriott International, Inc., Customer Data Security Breach Litigation, MDL No. 19-md-2879, in the U.S. District Court for the District of Maryland before Judge Paul W. Grimm. Plaintiffs alleged negligence, breach of contract, and violations of state consumer-protection and privacy statutes. The MDL addressed Marriott’s data-security practices, Starwood’s legacy systems, cybersecurity diligence during and after the Starwood acquisition, and claimed consumer losses tied to the breach.
Marriott announced that unauthorized actors had accessed the Starwood guest reservation database, which became part of Marriott after the 2016 Starwood acquisition. The company initially reported that up to approximately 500 million guests could have been affected. The disclosed information included names, mailing addresses, email addresses, phone numbers, birth dates, reservation details, passport numbers, and some payment card information. Marriott later revised the affected-record estimate to about 383 million records as an upper limit, not 383 million unique guests.
The Judicial Panel on Multidistrict Litigation centralized the federal lawsuits in the U.S. District Court for the District of Maryland as MDL No. 19-md-2879. The litigation was assigned to Judge Paul W. Grimm. The centralized actions involved overlapping allegations about Marriott’s cybersecurity practices, the Starwood reservation system, alleged consumer injury, and state privacy and consumer-protection claims.
During class-certification discovery, plaintiffs served the initial Rule 26 expert report of economist Dr. Jeffrey T. Prince on July 12, 2021. Dr. Prince was deposed on August 13, 2021. Defendants Marriott and Accenture served the expert report of economist Dr. Catherine E. Tucker on September 7, 2021, and Dr. Tucker was deposed on September 29, 2021. After disputes arose over Dr. Prince’s rebuttal opinions and testimony, Judge Grimm allowed Dr. Tucker to provide a supplemental report, which was filed on February 18, 2022.
Judge Grimm granted class certification in part and denied it in part. The court certified three Rule 23(b)(3) damages classes for Maryland, New York, and California claims, and four Rule 23(c)(4) issue classes tied to Florida, Maryland, Connecticut, and Georgia negligence-related issues. The court denied certification of the Michigan ITPA damages class, denied without prejudice classes relying on a loss-of-market-value theory, and denied without prejudice a class for injunctive or declaratory relief.
That same day, Judge Grimm issued a companion Daubert ruling addressing expert admissibility. Plaintiffs relied on Dr. Prince for classwide damages opinions concerning alleged overpayment and the claimed market value of compromised personal information. Marriott and Accenture relied on Dr. Tucker to challenge whether those alleged harms and damages could be measured through common proof. The court denied the defense motion to exclude Dr. Prince’s overpayment model for class-certification purposes, but granted the motion to exclude his model for calculating the market value of compromised personal information.
The class-certification record also cited plaintiffs’ data-security expert Mary Frantz. Her report was discussed as part of plaintiffs’ common evidence on duty and breach issues tied to Marriott’s data-security practices.
In the related City of Chicago enforcement track, the District of Maryland issued a memorandum opinion addressing Marriott’s Daubert motion, Rule 12(b)(1) motion, and summary-judgment motion. The opinion focused on Chicago’s claims under a local consumer-protection ordinance, including standing, monetary fines, home-rule authority, and extraterritoriality arguments. The court denied Marriott’s Daubert motion, granted in part and denied in part Marriott’s Rule 12(b)(1) motion, and denied Marriott’s summary-judgment motion.
The Fourth Circuit vacated the initial class-certification order and remanded the case. The appellate court held that the district court should have considered the effect of class-action waivers in the Starwood Preferred Guest contracts before certifying damages classes against Marriott. The Fourth Circuit also stated that the issue classes against Accenture depended in part on the damages classes against Marriott.
After remand, the district court again granted class certification. Judge Grimm concluded that Marriott could not rely on the class-action waiver because, in the district court’s view, Marriott had waived that defense through its conduct in the MDL. This ruling later became the subject of the 2025 Fourth Circuit appeal in Maldini v. Marriott International, Inc.
On October 9, 2024, Marriott reached a $52 million multistate settlement with 49 states and the District of Columbia. That same day, the FTC announced a proposed order involving Marriott and Starwood. On December 20, 2024, the FTC finalized an order requiring Marriott and Starwood to implement a comprehensive information-security program, limit data retention, provide a way for U.S. customers to request deletion of certain personal information, review loyalty accounts on request, and restore stolen loyalty points when appropriate.
In Maldini v. Marriott International, Inc., Nos. 24-1064 and 24-1065, the Fourth Circuit reversed the district court’s recertification order. The court held that Marriott did not waive its right to rely on the Starwood Preferred Guest class-action waiver and that the waiver was valid and enforceable. The Fourth Circuit reversed certification of all classes against Marriott and also reversed the issue classes against Accenture because those classes had been justified in connection with the Marriott damages classes. The ruling did not decide the merits of individual consumer claims.
Dr. Jeffrey T. Prince - Economics and Damages Expert Witness for Plaintiffs
Dr. Jeffrey T. Prince was a named economics expert for the consumer plaintiffs. He offered classwide damages opinions tied to alleged overpayment and the claimed market value of compromised personal information. His overpayment model addressed the difference between what class members allegedly paid for Starwood hotel rooms and what they would have paid in a hypothetical market where consumers knew about Starwood’s alleged data-security deficiencies. The court allowed his overpayment methodology for class-certification purposes but excluded his model for calculating the market value of compromised personal information.
Dr. Catherine E. Tucker - Economics and Damages Expert Witness for Marriott and Accenture
Dr. Catherine E. Tucker was a named economics expert for defendants Marriott and Accenture. She critiqued Dr. Prince’s classwide damages models and addressed whether the proposed injury and damages theories could be reliably measured across proposed classes. Her reports and deposition testimony were part of the Daubert and class-certification record. After disputes over Dr. Prince’s rebuttal opinions, the court allowed Dr. Tucker to provide a supplemental report responding to Dr. Prince’s rebuttal report and second deposition testimony.
Mary Frantz - Data-Security Expert Witness for Plaintiffs
Mary Frantz was a named data-security expert for plaintiffs in the class-certification record. Judge Grimm cited her report as part of plaintiffs’ evidence on duty and breach issues tied to Marriott’s data-security practices. Her role related to technical and security questions involving the Starwood reservation-system breach, including the alleged failures plaintiffs sought to prove through common evidence.
Dr. Coleman Bazelon - Standing and Economic Analysis Expert Witness for the City of Chicago
Dr. Coleman Bazelon was a named expert for the City of Chicago in the related government-enforcement track. His opinions addressed whether Chicago suffered a loss of tax revenue traceable to the Marriott data breach announcement. Marriott moved to exclude his opinions, but the court denied the Daubert motion and treated his opinions as sufficient at that stage on the standing issue.
Dr. Divya Mathur - Defense Economic Expert Witness for Marriott in the City of Chicago Track
Dr. Divya Mathur was a named defense expert for Marriott in the City of Chicago track. Her opinions challenged aspects of Dr. Bazelon’s model, including convention-related hotel bookings, competitor-hotel data, and economic explanations for tax-revenue changes after the breach announcement. The court treated several disputes between Dr. Mathur and Dr. Bazelon as issues going to weight rather than admissibility.
Cybersecurity, Digital Forensics, and Data-Governance Expert Witnesses
Cybersecurity, digital forensics, and data-governance experts are often used in data breach litigation to evaluate network architecture, incident response, intrusion timelines, malware activity, credential compromise, legacy-system risks, access controls, encryption, breach notification, and data retention. In the Marriott litigation, those topics related to the Starwood reservation environment, the intrusion period, Marriott’s post-acquisition systems review, and the information-security measures later addressed in government enforcement materials. Public materials reviewed for this revision confirm the named experts above; any additional technical experts should be identified by name only if supported by court filings or other reliable records.
Cybersecurity Diligence in Corporate Acquisitions
The Marriott litigation involved alleged vulnerabilities in Starwood systems that Marriott acquired in 2016. Acquisition-related IT review, legacy-system risks, and post-closing system integration appeared across the pleadings, expert record, and regulatory materials.
Expert Evidence in Class Certification
The district court reviewed expert opinions on whether alleged injury, causation, and damages could be assessed through common proof. Dr. Prince and Dr. Tucker offered competing economic opinions on classwide damages, and the court separated the overpayment model from the excluded market-value model. Mary Frantz’s report also appeared in the class-certification record on duty and breach issues tied to Marriott’s data-security practices.
Regulatory Compliance and Injunctive Relief
The 2024 multistate settlement and FTC final order required Marriott and Starwood to make information-security program changes, use data-retention limits, and provide consumer-facing privacy measures. Those government resolutions proceeded separately from the consumer MDL.
Economic Modeling of Data Breach Harm
The court’s 2022 class-certification and Daubert rulings addressed whether alleged overpayment and loss-of-value theories could be measured on a classwide basis. The court allowed the overpayment model for class-certification purposes but excluded the model for calculating the market value of compromised personal information.
Contract Terms and Class Recovery
The Fourth Circuit’s 2025 ruling enforced class-action waivers in Starwood Preferred Guest contracts. The decision reversed class certification against Marriott and the related issue classes against Accenture, while leaving individual claims and government enforcement proceedings outside the merits of that ruling.
The Marriott data breach litigation moved through consumer class claims in the Maryland MDL, related government-enforcement proceedings, regulatory resolutions, and appellate review of class-action waivers. Judge Grimm’s 2022 rulings certified three damages classes and four issue classes at that stage, while also addressing competing expert opinions on injury, damages, duty, and breach. In 2024, Marriott reached a $52 million multistate settlement and became subject to a finalized FTC order requiring changes to information-security practices. In 2025, the Fourth Circuit enforced class-action waivers in Starwood Preferred Guest contracts, reversed class certification against Marriott, and reversed the related Accenture issue classes without deciding the merits of individual consumer claims.
What triggered the Marriott data breach lawsuit?
The litigation followed Marriott’s 2018 disclosure that unauthorized actors had accessed the Starwood guest reservation database. The breach began before Marriott acquired Starwood and remained undetected until 2018.
What information was involved in the Starwood data breach?
The accessed information included names, mailing addresses, email addresses, phone numbers, dates of birth, reservation details, passport numbers, loyalty information, and some payment card information. Marriott later revised the affected-record estimate to about 383 million records as an upper limit.
How much was the Marriott data breach settlement with state attorneys general?
Marriott agreed to pay $52 million in a multistate settlement with 49 states and the District of Columbia in 2024. That settlement resolved state attorney general claims and was separate from the consumer MDL.
What did the FTC order require Marriott and Starwood to do?
The FTC final order required Marriott and Starwood to implement a comprehensive information-security program, limit retention of personal information, provide a way for U.S. customers to request deletion of certain personal information, review loyalty accounts on request, and restore stolen loyalty points when appropriate.
What did the Fourth Circuit decide in Maldini v. Marriott International, Inc.?
The Fourth Circuit enforced class-action waivers in Starwood Preferred Guest contracts and reversed class certification against Marriott. The court also reversed the related issue classes against Accenture because they depended on the Marriott damages classes.
Dr. Jeffrey T. Prince - Economics and Damages Expert Witness for Plaintiffs
Dr. Jeffrey T. Prince was a named economics expert for the consumer plaintiffs. He offered classwide damages opinions tied to alleged overpayment and the claimed market value of compromised personal information. His overpayment model addressed the difference between what class members allegedly paid for Starwood hotel rooms and what they would have paid in a hypothetical market where consumers knew about Starwood’s alleged data-security deficiencies. The court allowed his overpayment methodology for class-certification purposes but excluded his model for calculating the market value of compromised personal information.
Dr. Catherine E. Tucker - Economics and Damages Expert Witness for Marriott and Accenture
Dr. Catherine E. Tucker was a named economics expert for defendants Marriott and Accenture. She critiqued Dr. Prince’s classwide damages models and addressed whether the proposed injury and damages theories could be reliably measured across proposed classes. Her reports and deposition testimony were part of the Daubert and class-certification record. After disputes over Dr. Prince’s rebuttal opinions, the court allowed Dr. Tucker to provide a supplemental report responding to Dr. Prince’s rebuttal report and second deposition testimony.
Mary Frantz - Data-Security Expert Witness for Plaintiffs
Mary Frantz was a named data-security expert for plaintiffs in the class-certification record. Judge Grimm cited her report as part of plaintiffs’ evidence on duty and breach issues tied to Marriott’s data-security practices. Her role related to technical and security questions involving the Starwood reservation-system breach, including the alleged failures plaintiffs sought to prove through common evidence.
Dr. Coleman Bazelon - Standing and Economic Analysis Expert Witness for the City of Chicago
Dr. Coleman Bazelon was a named expert for the City of Chicago in the related government-enforcement track. His opinions addressed whether Chicago suffered a loss of tax revenue traceable to the Marriott data breach announcement. Marriott moved to exclude his opinions, but the court denied the Daubert motion and treated his opinions as sufficient at that stage on the standing issue.
Dr. Divya Mathur - Defense Economic Expert Witness for Marriott in the City of Chicago Track
Dr. Divya Mathur was a named defense expert for Marriott in the City of Chicago track. Her opinions challenged aspects of Dr. Bazelon’s model, including convention-related hotel bookings, competitor-hotel data, and economic explanations for tax-revenue changes after the breach announcement. The court treated several disputes between Dr. Mathur and Dr. Bazelon as issues going to weight rather than admissibility.
Cybersecurity, Digital Forensics, and Data-Governance Expert Witnesses
Cybersecurity, digital forensics, and data-governance experts are often used in data breach litigation to evaluate network architecture, incident response, intrusion timelines, malware activity, credential compromise, legacy-system risks, access controls, encryption, breach notification, and data retention. In the Marriott litigation, those topics related to the Starwood reservation environment, the intrusion period, Marriott’s post-acquisition systems review, and the information-security measures later addressed in government enforcement materials. Public materials reviewed for this revision confirm the named experts above; any additional technical experts should be identified by name only if supported by court filings or other reliable records.
Cybersecurity Diligence in Corporate Acquisitions
The Marriott litigation involved alleged vulnerabilities in Starwood systems that Marriott acquired in 2016. Acquisition-related IT review, legacy-system risks, and post-closing system integration appeared across the pleadings, expert record, and regulatory materials.
Expert Evidence in Class Certification
The district court reviewed expert opinions on whether alleged injury, causation, and damages could be assessed through common proof. Dr. Prince and Dr. Tucker offered competing economic opinions on classwide damages, and the court separated the overpayment model from the excluded market-value model. Mary Frantz’s report also appeared in the class-certification record on duty and breach issues tied to Marriott’s data-security practices.
Regulatory Compliance and Injunctive Relief
The 2024 multistate settlement and FTC final order required Marriott and Starwood to make information-security program changes, use data-retention limits, and provide consumer-facing privacy measures. Those government resolutions proceeded separately from the consumer MDL.
Economic Modeling of Data Breach Harm
The court’s 2022 class-certification and Daubert rulings addressed whether alleged overpayment and loss-of-value theories could be measured on a classwide basis. The court allowed the overpayment model for class-certification purposes but excluded the model for calculating the market value of compromised personal information.
Contract Terms and Class Recovery
The Fourth Circuit’s 2025 ruling enforced class-action waivers in Starwood Preferred Guest contracts. The decision reversed class certification against Marriott and the related issue classes against Accenture, while leaving individual claims and government enforcement proceedings outside the merits of that ruling.
The Marriott data breach litigation moved through consumer class claims in the Maryland MDL, related government-enforcement proceedings, regulatory resolutions, and appellate review of class-action waivers. Judge Grimm’s 2022 rulings certified three damages classes and four issue classes at that stage, while also addressing competing expert opinions on injury, damages, duty, and breach. In 2024, Marriott reached a $52 million multistate settlement and became subject to a finalized FTC order requiring changes to information-security practices. In 2025, the Fourth Circuit enforced class-action waivers in Starwood Preferred Guest contracts, reversed class certification against Marriott, and reversed the related Accenture issue classes without deciding the merits of individual consumer claims.
What triggered the Marriott data breach lawsuit?
The litigation followed Marriott’s 2018 disclosure that unauthorized actors had accessed the Starwood guest reservation database. The breach began before Marriott acquired Starwood and remained undetected until 2018.
What information was involved in the Starwood data breach?
The accessed information included names, mailing addresses, email addresses, phone numbers, dates of birth, reservation details, passport numbers, loyalty information, and some payment card information. Marriott later revised the affected-record estimate to about 383 million records as an upper limit.
How much was the Marriott data breach settlement with state attorneys general?
Marriott agreed to pay $52 million in a multistate settlement with 49 states and the District of Columbia in 2024. That settlement resolved state attorney general claims and was separate from the consumer MDL.
What did the FTC order require Marriott and Starwood to do?
The FTC final order required Marriott and Starwood to implement a comprehensive information-security program, limit retention of personal information, provide a way for U.S. customers to request deletion of certain personal information, review loyalty accounts on request, and restore stolen loyalty points when appropriate.
What did the Fourth Circuit decide in Maldini v. Marriott International, Inc.?
The Fourth Circuit enforced class-action waivers in Starwood Preferred Guest contracts and reversed class certification against Marriott. The court also reversed the related issue classes against Accenture because they depended on the Marriott damages classes.
Information Security
Computer Security
Online Privacy
Consumer Protection
Class Certification
Damage Analysis
Economic Analysis
Hotel Due Diligence
Hospitality
Human Factors, +4
Hospitality