Vermont Privacy Enforcement Cases

Why the action was brought

Marriott’s Starwood guest reservation database was breached from July 2014 through September 2018, exposing 131.5 million U.S. guest records, including contact and reservation information, preferences, and some passport and payment-card data. The company allegedly failed to implement reasonable data security and remediate deficiencies while using and integrating Starwood, leading to consumer exposure.

Why the action was brought

Blackbaud’s deficient security and failure to remediate known gaps allowed unauthorized access during a 2020 ransomware event, exposing Social Security numbers, driver’s license numbers, financial information, employment and wealth information, donation history, and protected health information. It allegedly delayed or omitted required notifications and provided incomplete or inaccurate information, affecting over 13,000 customers and more than 15,000 Vermonters.

Why the action was brought

The settlements addressed 2012 and 2015 Experian data breaches compromising personal information of millions, including 2,133 Vermont consumers. EDC failed to prevent or provide notice of a 2012 breach after an identity thief posing as a private investigator accessed sensitive information. T-Mobile agreed to strengthen vendor oversight.