Marriott Moves to Dismiss Data Breach Lawsuit, Says Passport Numbers Useless to Hackers

Marriott is insisting that last year's cyberattack did no harm to its hotel guests, not least of which because hackers cannot use stolen passport numbers.

In a motion filed on September 23, Marriott International Inc. sought to dismiss a consolidated consumer class action brought over the data breach, which compromised the personal information of 383 million guests of its Starwood Hotels and Resorts Worldwide properties. Parroting the argument of other defendants in data breach cases, Marriott insisted that none of the named plaintiffs in the case suffered harm, which is required to establish standing to sue in federal court.

But, in a more unusual move, the hotel chain, which admitted that hackers stole passport numbers, attached a declaration from Brenda Sprague, who held the "highest-ranking position in the U.S. government with responsibility for passports" at the U.S. Department of State Bureau of Consular Affairs. In that declaration, she said that hackers need more than a passport number to create a forged passport.

"The bellwether plaintiffs have not alleged they have suffered any form of passport fraud," wrote Marriott's attorney, Daniel Warren, a partner at Baker & Hostetler in Cleveland.

He added that the complaint included "an everything-but-the-kitchen-sink" list of alleged harms, few of which even happened to the named plaintiffs. "Plaintiffs' one-size-fits-all pleading style is entitled to zero weight on a motion to dismiss," he wrote.

A Marriott spokesman declined to comment, and Warren did not respond to a request for comment. Lead plaintiffs attorneys in the data breach case — Andrew Friedman, a partner at Cohen Milstein Sellers & Toll in Washington, DC; Amy Keller of Chicago's DiCello Levitt; and James Pizzirusso, a partner at Hausfeld in Washington, DC — also did not respond.

On Nov. 30, Marriott announced that a breach compromised the personal data of 500 million guests of its Starwood Hotels and Resorts Worldwide properties. Marriott later lowered that figure to fewer than 383 million.

Marriott's motion comes as U.S. District Judge Paul Grimm, who is overseeing the multidistrict litigation in Maryland, has put the data breach case on a fast track. He has told lawyers he plans to rule on the motions to dismiss by the end of the year.

Hotel guests are not the only ones suing Marriott over the breach. Financial institutions and shareholders have brought separate cases, as has the city of Chicago.

On July 31, Marriott filed a motion to dismiss the class action for financial institutions, which alleged they had to reissue payment cards to customers impacted by the breach. The motion says the lead plaintiff, the Bank of Louisiana, lacked standing to sue over such costs, which were preventative. Further, the bank, which was a lead plaintiff in the Equifax data breach case, could not prove that the Marriott breach, as opposed to another cyber-attack, caused any unauthorized charges.

In a July 15 motion, Marriott insisted that the city of Chicago lacked legal authority to sue over a breach that is national in scope. Marriott's motions to dismiss the shareholder cases are due in November.

In the consumer case, Marriott argued that the majority of the plaintiffs did not allege hackers misused their information. Of those who did, many of the nine million credit and debit cards, and 24 million passport numbers, could have been expired, given that the breach involved information dating back to 2002 — making the prospect of identity theft "pure conjecture." Further, hackers would have had to decrypt most of the payment cards and passport information, and plaintiffs provided no evidence that such information was for sale on the "dark web."

Sprague, who is immediate past deputy assistant secretary of state for passport services in the U.S. Department of State Bureau of Consular Affairs, said in her declaration that criminals have to obtain real passport books, not just the numbers, to create forgeries, both online and at the U.S. border. She also said that electronic passports, available since 2005, have coded chips embedded in them.

"A U.S. passport is virtually impossible to forge successfully," she wrote. "In my 10 years in charge of passport services, I was aware of no incidents in which the Department encountered a credible forgery of a U.S. passport."

Two plaintiffs also alleged they had bank accounts opened in their name, one of whom also alleged an unauthorized individual collected a tax refund, but Marriott insisted in its motion that both those actions require Social Security numbers, which hackers did not take.

Marriott also said plaintiffs failed to alleged sufficient facts under various state statutes, citing "sloppy pleading" and "vague allegations."

*****

Amanda Bronstad is the ALM staff reporter covering class actions and mass torts nationwide. Based in Los Angeles, she writes the email dispatch Critical Mass.