Hotel group Marriott International is facing a class action lawsuit in London’s high court from millions of customers, who are seeking compensation after their personal details were stolen in one of the world’s largest data breaches. Martin Bryant, a technology consultant, is leading the legal action on behalf of people living in England or Wales who made a reservation to stay at one of Marriott International’s Starwood properties before 10 September 2018. Those who reserved rooms in any of the affected hotels around the world, including Marriott’s W Hotels, Sheraton Hotels & Resorts, Westin Hotels & Resorts and Le Méridien Hotel & Resorts, will be automatically included in the lawsuit unless they decide to opt out. Marriott International revealed in September 2018 that personal data including credit card details, passport numbers and the dates of birth of more than 300 million people had been stolen in a hack of its global guest reservation database. When the group investigated the breach, it discovered that unauthorised access to its systems had been going on since 2014, and that unidentified hackers had stolen the details of 339 million guests. Bryant said he had brought the case because consumers “don’t always realise the risks we are exposed to when our data is compromised through no fault of our own”. “I hope this case will raise awareness of the value of our personal data, result in fair compensation … and also serve notice to other data owners that they must hold our data responsibly,” he said. Bryant is represented by the law firm Hausfeld, and the claim is being funded by Harbour Litigation Funding. Michael Bywell, a partner at Hausfeld, said Marriott International had failed over several years “to take adequate technical or organisational measures to protect millions of their guests’ personal data which was entrusted to them”. Marriott International declined to comment on the high court suit. The UK’s data watchdog, the Information Commissioner’s Office (ICO), revealed in July 2019 its intention to fine Marriott International almost £100m as a result of the data breach. The ICO proposed a £99.2m fine for Marriott, after finding that about 7 million of the customers whose records were hacked were UK residents. Marriott has appealed against the fine via submissions to the regulator. The company and the ICO have agreed to extend the regulatory process until 30 September, after which the regulator will make its final decision. The ICO’s proposed fine for Marriott International was one of two hefty penalties it proposed using powers relating to breaches under the EU’s General Data Protection Regulation (GDPR), which came into force in 2018 and allows for fines of up to 4% of turnover, depending on the severity of security failings. British Airways was hit with a £183m fine by the ICO for a hack of the personal data of half a million of its customers, the watchdog’s first GDPR fine, which the airline is appealing against. Before the introduction of GDPR, internet service provider TalkTalk was fined £400,000 in 2016 for security failings which led to a cyber attack. The firm was run at the time of the hack by Dido Harding, recently appointed the head of the new National Institute for Health Protection. The suit filed against Marriott International would serve as a wake-up call to companies about the penalties they may face for not prioritising cybersecurity, said Stuart Reed, UK director at information technology services provider Orange Cyberdefense. “It is essential that all organisations take the utmost care and due diligence when applying relevant processes and procedures for good data hygiene,” he said. “Cybersecurity is the responsibility of all within the organisation. Ongoing education and awareness amongst employees from the board down is critical to ensuring a layered approach of people, process and technology, and to preventing costly customer data breaches.”