Arkansas Attorney General Tim Griffin announced a settlement with Marriott International, Inc. regarding a significant data breach. Arkansas will receive $804,965 as part of the agreement involving 50 attorneys general.
“With Cybersecurity Awareness Month in full swing, this settlement is yet another reminder how widespread data breaches are, and how many lives they touch—including the lives of those who travel for business, visit family, or vacation," Griffin stated. "I remain committed to holding companies accountable for data breaches while encouraging Arkansans to be vigilant and protect their personal information and passwords.”
The settlement requires Marriott to enhance its data security practices using a risk-based approach and provide certain consumer protections. The company will pay $52 million to various states.
Marriott acquired Starwood Hotels and Resorts Worldwide, LLC in 2016. However, intruders accessed the Starwood computer network from July 2014 until September 2018 without detection. This breach affected 131.5 million guest records in the United States, including contact details, birth dates, reservation information, and some unencrypted passport numbers and payment card details.
The resolution addresses allegations that Marriott violated state consumer protection laws by failing to implement adequate data security measures during its integration with Starwood systems.
Under the terms of the settlement, Marriott will conduct annual enterprise-level risk assessments and ongoing analyses throughout the year. The company must also offer multi-factor authentication for loyalty rewards accounts like Marriott Bonvoy.
Connecticut, Maryland, Oregon, the District of Columbia, Illinois, Louisiana, Massachusetts, North Carolina, and Texas led the multistate investigation. They were supported by an Executive Committee comprising Alabama and several other states.
For more details on this case or related documents such as complaints or consent judgments are available upon request.