New Hampshire Privacy Enforcement Cases

Why the action was brought

Inmediata’s website configuration made patients’ electronic protected health information accessible to unauthorized internet users and searchable through Google. The exposed information included names, addresses, dates of birth, medical record numbers, health-insurance information, and medical information, affecting approximately 1.5 million individuals and creating risk of unauthorized disclosure.

Why the action was brought

Marriott’s Starwood guest-reservation database was compromised in four incidents between 2014 and 2020, exposing names, addresses, phone numbers, email addresses, passport numbers, dates of birth, gender, loyalty-account information, and reservation details. The states alleged Marriott lacked reasonable safeguards, failed to detect and contain unauthorized access, and delayed breach notifications, increasing consumers’ risks of identity theft and fraud.

Why the action was brought

Carnival experienced multiple data breaches that exposed consumers’ and employees’ personal information. The investigation found that Carnival failed to maintain reasonable data-security practices, adequately protect personal information, detect and respond to incidents, and provide timely notice concerning the breaches, causing potential harm to affected individuals.