Arkansas Privacy Enforcement Cases

Why the action was brought

Blackbaud’s 2020 ransomware attack exposed Arkansans’ personal information and affected millions of Americans. The company failed to implement reasonable data security, fix known security gaps, and provide customers timely, complete, or accurate breach information, violating Arkansas’s Deceptive Trade Practices Act and Personal Information Protection Act. The stated harm was the data breach and potential further misuse.

Why the action was brought

The settlement resolves allegations that Marriott failed to implement reasonable data security and remediate deficiencies, particularly while integrating Starwood. Intruders remained undetected from July 2014 through September 2018, resulting in the breach of 131.5 million U.S. guest records containing contact information, reservation details, preferences, and limited passport and payment-card information.

Why the action was brought

In 2023, 23andMe discovered a data breach affecting 6.9 million consumers, including more than 48,000 Arkansans. The breach exposed customer data, sometimes including genetic ancestry information. The statement says the company initially denied the breach and blamed customers for account setup, and holds it accountable for failing to protect Arkansans’ data.