New Jersey Privacy Enforcement Cases

Why the action was brought

States alleged Marriott misrepresented how it protected consumers’ personal information and failed to use adequate cybersecurity safeguards. Intruders accessed Starwood’s guest reservation database from 2014 to 2018, exposing contact information, gender, dates of birth, reservation information, preferences, passport numbers, and payment-card information. About 131.5 million Americans were impacted; a second incident exposed over 5.2 million guest records.

Why the action was brought

Blackbaud’s software stored Social Security numbers, driver’s license numbers, donation history, contact and demographic details, and financial, employment, and protected health information. It allegedly failed to implement reasonable security, remediate known gaps, and timely provide complete, accurate breach information after unauthorized network access in a 2020 ransomware attack, delaying or preventing consumer notification.

Why the action was brought

An unauthorized user accessed AMCA’s internal system from August 2018 through March 2019 and collected Social Security numbers, payment-card information, and sometimes medical-test names and diagnostic codes. AMCA allegedly violated state consumer-protection and data-privacy laws by failing to detect the eight-month intrusion despite warnings from banks, exposing information of more than seven million people, including over 246,000 New Jersey residents.