Marriott and Starwood Hotel Guests
Total Page:16
File Type:pdf, Size:1020Kb
• Case 8:18-cv-03804-GJH Document 1 Filed 12/11/18 Page 1 of 52 FtL-O US. DISTRICT COURT IIISTRICT OF HARYL; 110 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND 20 IBDEC I I PH 12: 2 I GREENBELT DIVISION CLERH'S OFF ICE fiT GHEf.NBELT RONALD N. WALTERS AND KENNETH Case No.: /1l'__ V__ DEPUTY TEW, individually and on behalf of all others similarly situated, !GJH 18 CV3804 Plaintiffs, CLASS ACTION COMPLAINT v. JURY TRIAL DEMANDED MARRIOTT INTERNATIONAL, INC.; STARWOOD HOTELS & RESORTS WORLDWIDE, LLC Defendants. I. INTRODUCTION Plaintiffs Ronald N. Walters and Kenneth Tew ("Plaintiffs") bring this class action against Marriott International, Inc. (referred to herein as "Marriott" or "Marriott International"), parent of Starwood Hotels & Resorts Worldwide, LLC (referred to herein as "Starwood") (collectively, "Defendants"), for Starwood's failure to secure and safeguard its customers' personally identifiable information ("PII") such as the passport information, customers' names, mailing addresses, and other personal information, as well as credit and debit card numbers and other payment card data ("PCD") (collectively, "Private Information"). Marriott and Starwood collected this information at the time customers registered on its website, checked-in to one of its hotels, used its loyalty program (the "Loyalty Program"), and/or used it at one of its dining or retail operations within its hotels. Marriott and Starwood also failed to provide timely, accurate, and adequate notice to Plaintiffs and other Class Members (defined below) that their Private Information had been stolen, as well as precisely what types of information were stolen. When consumers provided information in their Starwood accounts or checked in to Starwood hotels, Starwood (now Marriott) electronically collected and stored this information, making it a treasure trove of useful information attractive Case 8:18-cv-03804-GJH Document 1 Filed 12/11/18 Page 2 of 52 to hackers who used the information to profit and cause damage, as was done here, to consumers. Beginning In or around 2014 (and perhaps even earlier) and continuing through November 2018, hackers exploiting vulnerabilities in Starwood's network accessed the guest reservation system at Starwood hotels and stole this data (the "Data Breach"). On or about November 30,2018, Marriott acknowledged an investigation had determined that there was unauthorized access to the Starwood guest reservation database, which contained guest information relating to reservations at Starwood properties on or before September 10, 2018. Marriott has not finished identifying duplicate information in the database, but believes it contains information on up to approximately 500 million guests who made a reservation at a Starwood property. For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ("SPG") account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. For some, the information also includes payment card numbers and payment card expiration dates. Marriott could have prevented this Data Breach. Numerous other hotel chains, including Hilton, Starwood (previously), Kimpton, Mandarin Oriental, White Lodging (on two occasions), and the Trump Collection, have been hit with similar data breaches. While many retailers, banks, and card companies responded to recent breaches by adopting technology that helps make transactions and databases more secure, on information and belief Starwood and Marriott did not. Marriott disregarded Plaintiffs' and Class Members' rights by intentionally, willfully, recklessly, or negligently failing to take adequate and reasonable measures to ensure its data systems were protected, failing to take available steps to prevent and stop the breach from ever happening, and failing to disclose to its customers the material facts that it did not have adequate computer systems and security practices to safeguard customers' Private Information. 2 Case 8:18-cv-03804-GJH Document 1 Filed 12/11/18 Page 3 of 52 On information and belief, Plaintiffs' and Class Members' Private Information was improperly handled and stored, was unencrypted, and was not kept in accordance with applicable, required, and appropriate cyber-security protocols, policies, and procedures; Plaintiffs' PCD was encrypted. As a result, Plaintiffs' and Class Members' Private Information was compromised and stolen. However, as this same information remains stored in Marriott's computer systems, Plaintiffs and Class Members have an interest in ensuring that their information is safe, and they are entitled to seek injunctive and other equitable relief, including independent oversight of Marriott's security systems. II. THE PARTIES A. Plaintiffs I. Plaintiff and class representative Ronald N. Walters is a United States citizen and resident of Kanawaha County, West Virginia, and has been a long-time SPG member. Mr. Walters provided his personal and confidential information to Defendants on the basis that they would keep his information secure, employ reasonable and adequate security measures to ensure that hackers would not compromise his information, and notify him promptly in the event of a breach. On November 30, 20 18, Plaintiff Walters was notified that his information was compromised by the Data Breach. Plaintiff Walters was notified of the breach again on December 10, 2018 by Marriott International. As a result of the Data Breach, Mr. Walters is taking measures that he otherwise would not have to take to ensure that his identity is not stolen and that his accounts are not compromised. 2. Plaintiff and class representative Kenneth Tew, Ph.D. is a dual citizen of the United States and the United Kingdom, and resident of Charleston County, South Carolina. Plaintiff Tew has been a long-time SPG member. Dr. Tew provided his personal and confidential information to Defendants on the basis that they would keep his information secure, employ reasonable and adequate security measures to ensure that hackers would not compromise his information, and notify him promptly in the event of a breach. On November 3 Case 8:18-cv-03804-GJH Document 1 Filed 12/11/18 Page 4 of 52 30, 2018, Plaintiff Tew was notified that his information was compromised by the Data Breach. As a result of the Data Breach, Dr. Tew is taking measures that he otherwise would not have to take to ensure that his identity is not stolen and that his accounts are not compromised. B. Defendants 3. Defendant Marriott International, Inc. is a Delaware corporation with its principal place of business located in the State of Maryland at 10400 Fernwood Road, Bethesda, Maryland 20817. 4. Defendant Marriott operates, franchises, and licenses hotel, residential, and time share properties worldwide through various subsidiaries, each of which act as an agent of or in concert with Marriott. 5. Defendant Starwood Hotels & Resorts Worldwide, LLC is a subsidiary company of Marriott International, Inc., with its principal place of business at One StarPoint, Stamford, Connecticut. III. JURISDICTION AND VENUE 6. This Court has jurisdiction pursuant to 28 U.S.c. S I 332(d), the Class Action Fairness Act, because this suit is a class action, the parties are diverse, and the amount in controversy exceeds $5 million, excluding interest and costs. The Court has supplemental jurisdiction over the related state law claims pursuant to 28 U.S.C. S 1367. 7. Venue is proper under 28 U.S.c. SI391(c) because Defendants are corporations that do business in and are subject to personal jurisdiction in the District of Maryland. Venue is also proper because a substantial part of the events or omissions giving rise to the claims in this action occurred in or emanated from this district, including decisions made by Defendants Marriott and Starwood to permit the unauthorized collection of the personally identifiable information of the class. IV. FACTUAL ALLEGATIONS 4 Case 8:18-cv-03804-GJH Document 1 Filed 12/11/18 Page 5 of 52 A. Background 8. Defendant Marriott is the largest hotel chain in the world, with more than 6,500 properties located in 127 countries and territories globally. Marriott owns and operates a variety of hotel, lodging, and hospitality brands, including hotels under its Starwood brands, which include W Hotels, SI. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le ivIeridien Hotels & Resorts, Four Points by Sheraton, and Design Hotels. Hundreds of millions of customers have made reservations and stayed at Marriott properties around the globe. 9. In November 2015, Marriott announced that it was purchasing Starwood for $13.6 billion, creating the world's largest hotel empire.' 10. Starwood includes the following hotel brands: W Hotels, SI. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Meridien Hotels & Resorts, Four Points by Sheraton, and Design Hotels, as well as Starwood-branded timeshare properties.' 'II. When booking reservations at a Marriott property, including its Starwood brand properties, customers provide Marriott with sensitive PlI, including their names, addresses, passport numbers and details, phone numbers, email addresses, dates of birth, gender, and credit card numbers with expiration dates. 12. Booking hotel reservations,