## Facts

- Marriott International acquired Starwood Hotels & Resorts Worldwide in September 2016 and later disclosed that the Starwood guest-reservation database had been accessed by hackers from July 2014 to September 2018.
- The compromised information allegedly included names, addresses, birth dates, email addresses, phone numbers, and in some cases passport and payment-card data.
- Consumer plaintiffs alleged harms including heightened risk of identity theft, mitigation costs (time and money spent monitoring accounts and responding to the breach), and economic injury based on an alleged overpayment theory for hotel stays.
- Numerous suits were centralized in a multidistrict litigation in the District of Maryland; plaintiffs filed a consolidated complaint asserting state-law negligence (against Marriott and Accenture), contract and implied-contract claims (against Marriott), and state consumer-protection claims (against Marriott).
- The parties selected ten state-law “bellwether” claims, and Marriott and Accenture moved to dismiss under Rule 12(b)(6).

## Issues

1. Whether the bellwether plaintiffs plausibly alleged Article III injury-in-fact traceable to the breach and redressable by judicial relief.
2. Whether Marriott and Accenture owed a common-law duty to use reasonable care to safeguard customers’ personal information under the relevant states’ negligence doctrines.
3. Whether alleged harms such as risk of future identity theft, mitigation costs, and overpayment are cognizable damages for negligence under the applicable state laws.
4. Whether plaintiffs plausibly alleged express or implied contractual obligations by Marriott to provide reasonable data security based on privacy-related statements and the exchange of personal information for hotel services.
5. Whether plaintiffs sufficiently alleged deceptive statements or omissions, and statutory injury (such as “ascertainable loss”), under the relevant state consumer-protection statutes.

## Decision

- The court granted the motions to dismiss in part and denied them in part.
- The court generally found Article III standing adequately pled for bellwether plaintiffs whose data was plausibly exposed, based on alleged misuse, substantial risk of identity theft, and reasonable mitigation costs.
- Negligence claims against Marriott and Accenture were permitted to proceed in certain bellwether jurisdictions where plaintiffs plausibly alleged duty, breach, and cognizable damages; other negligence theories were dismissed on state-specific grounds (including limits on recovery for purely economic loss).
- Several express and implied contract claims against Marriott survived where the pleadings plausibly alleged an agreement (or implied promise) to use reasonable data security; other contract theories were dismissed where state law or the alleged facts were insufficient.
- Many consumer-protection claims survived at the pleading stage where plaintiffs alleged specific misrepresentations or omissions about data security and plausible economic loss (including overpayment); other statutory claims were dismissed where the alleged statements were non-actionable, too vague, or did not satisfy state-law injury requirements.

## Legal Principles

- In data-breach cases, concrete injury for Article III may be shown through actual misuse of compromised data, a sufficiently imminent and substantial risk of identity theft based on the type of data and circumstances of exposure, and reasonably incurred mitigation costs.
- A duty to exercise reasonable care to protect personal information may arise under state negligence law from foreseeability of cyberattack, the sensitivity and volume of data stored, and the service provider–customer relationship; whether such a duty exists depends on the governing state law.
- Present expenditures of time and money to mitigate a substantial risk of identity theft may constitute compensable injury or damages when reasonably incurred; some asserted categories (such as “diminution in value” of personal information) may be limited or unavailable under particular state laws.
- Contract or implied-contract obligations regarding data security may be plausibly alleged where consumers provide personal data in exchange for services and the business makes security-related commitments in privacy materials or through its practices; individualized proof of reading and assent may not be required at the pleading stage in some jurisdictions.
- Consumer-protection claims may proceed where plaintiffs plead concrete, specific misrepresentations or omissions about data security and a plausible economic loss (including overpayment) meeting the statute’s injury requirement, subject to state-by-state elements and pleading standards.

## Conclusion

The court largely allowed the MDL’s core claims to move forward, holding that many bellwether plaintiffs plausibly alleged standing and viable negligence, contract, and consumer-protection theories based on the breach, while dismissing particular claims and damages theories that failed under specific state-law rules or pleading requirements.


In re Marriott Int’l, Inc. Customer Data Sec. Breach Litig., 440 F. Supp. 3d 447 (D. Md. 2020)