Shutterstock.com

The first lawsuit filed over Marriott International Inc.'s data breach comes just hours after the hotel chain's announcement of the hack — and two lawyers are the plaintiffs.

The suit, filed in federal court in Maryland on behalf of attorneys Harry Bell and Ed Claffy, alleges Bethesda-based Marriott's failure to invest sufficient resources in security programs allowed the cyberattack, which compromised the personal information of 500 million guests of its Starwood properties, such as the W Hotel and Westin Hotels & Resorts, beginning in 2014. Morgan & Morgan filed the class action on behalf of the two lawyers and a nationwide class of Marriott consumers.

“I am highly disappointed in the fact these companies, Marriott/Starwood, with whom I have had a loyal relationship with for many years allowed this to happen,” Bell wrote in an email. “I reached out to John Morgan and his team due to their leadership and experience in claims of this type. My private information should be secure when I deal with companies such as these.”

Morgan & Morgan's John Yanchunis in Tampa, who was lead counsel in the Yahoo data breach litigation that settled Oct. 22 for $85 million, filed the suit along with William Murphy of Murphy Falcon Murphy in Baltimore.

“Large, sophisticated companies like Marriott are not blind to the risks posed by cyber criminals, who are constantly attempting to infiltrate corporations that store sensitive consumer information,” Yanchunis said. “The fact that a breach that began in 2014 went undetected for four years is shocking and horrifying.”

A Marriott spokesman did not respond to a request for comment by deadline.

On its website, Marriott said it had begun sending email notifications Friday to all those affected and is offering guests free enrollment for a year in WebWatcher, which monitors Internet sites and alerts consumers if their personal information appears.

“Marriott values our guests and understands the importance of protecting personal information,” the hotel chain said. “Marriott deeply regrets this incident happened. From the start, we moved quickly to contain the incident and conduct a thorough investigation with the assistance of leading security experts. Marriott is working hard to ensure our guests have answers to questions about their personal information with a dedicated website and call center.”

Marriott's announcement said it received a security alert Sept. 8 but did not discover what the specific compromised information was until Nov. 19. The investigation determined hackers had accessed the reservations database for its Starwood properties beginning in 2014. The internal investigation is ongoing, and the hotel has notified regulatory authorities and been in touch with law enforcement.

The company said the hack compromised the names, addresses and other information of its guests, about 327 million of whom might have had their passport numbers stolen. The hack also involved credit card numbers “for some,” despite encryption measures.

The lawsuit said Claffy, a partner at Thompson Flanagan in Chicago, stayed at Marriott hotels for the past eight years and Bell of Stewart Bell in Charleston, West Virginia, “for decades.”

The suit seeks punitive damages and reimbursement for fraudulent credit or debit card charges, out-of-pocket expenses incurred due to the breach, costs associated with not being able to use accounts and “ascertainable losses in the form of deprivation of the value” of plaintiffs' personal information. It also called Marriott's WebWatcher offering “inadequate” and sought “appropriate credit monitoring services.”

The suit cites Federal Trade Commission guidelines provided in a 2016 publication called “Protecting Personal Information: A Guide for Business,” and the federal agency's enforcement actions against businesses for violating Section 5 of the Federal Trade Commission Act.

“Marriott's failure to employ reasonable and appropriate measures to protect against unauthorized access to confidential consumer data constitutes an unfair act or practice prohibited by Section 5 of the FTC Act,” the complaint says.

FTC Chairman Joe Simons has pushed this year for legislation that would give the federal agency more power to levy fines over data breaches.