Indiana Privacy Enforcement Cases

Why the action was brought

Marriott’s Starwood guest reservation database was breached, exposing 131.5 million U.S. guest records, including contact information, dates of birth, reservation details, preferences, limited unencrypted passport numbers, and unexpired payment card information. Intruders remained undetected from July 2014 through September 2018. Attorneys general alleged Marriott failed to implement reasonable security and remediate deficiencies, particularly integrating Starwood.

Why the action was brought

Blackbaud’s deficient data security allowed hackers to access its network during a 2020 breach, exposing demographic information, Social Security numbers, driver’s license numbers, financial information, donation history, and protected health information belonging to consumers connected to more than 13,000 customers. Blackbaud allegedly violated consumer protection, breach-notification, and HIPAA requirements by delaying or omitting complete, accurate customer notification.

Why the action was brought

Morgan Stanley Smith Barney LLC allegedly exposed customers’ personal information through inadequate device decommissioning, including hiring an inexperienced moving company, failing to monitor disposal, auctioning equipment containing data, and losing 42 potentially unencrypted servers. The investigation found inadequate vendor controls and hardware inventories, allowing both data-security incidents to occur and risking disclosure of millions of customers’ sensitive information.