FTC And State AGs Settle With Marriott Over Starwood Data Breaches

Executive Summary

Our Consumer Protection/FTC and Privacy, Cyber & Data Strategy teams unpack Starwood Hotels' and Marriott International's settlements with the Federal Trade Commission and Marriott's settlement with state attorneys general over three data breaches.

• Highlights companies' potential liability for acquired entities' prior data security incidents or insufficient data security controls
• Emphasizes the importance of regularly updating and testing written-information security programs to identify and address vulnerabilities
• Underscores the need to consider enhancing response plans to effectively detect, report, escalate, and respond to security incidents

On October 9, 2024, the Federal Trade Commission (FTC) and state attorneys general (AGs) from 49 states and the District of Columbia announced a pair of parallel settlements with Marriott International Inc., resolving liability for a series of three data breaches from 2014 to 2020