MAR · 10-Q · 2026Q3 · Full report

Starwood Data Security Litigation

MARRIOTT INTERNATIONAL INC /MD/ · 2026-11-02 · Importance 20 · Surprise 24

Consumer and other lawsuits followed Marriott’s November 30, 2018 announcement of unauthorized access to the Starwood reservations database; U.S. cases were consolidated in the U.S. District Court for the District of Maryland, and Canadian cases remain pending. In 2025, the Fourth Circuit again reversed class certification, and some plaintiffs subsequently brought individual New York state-court lawsuits. Marriott has advanced settlement efforts with U.S. consumer plaintiffs and considers losses probable, but its September 30, 2026 accrual was not material; it cannot reasonably estimate potential losses above recorded amounts.

Key facts

• Marriott advanced settlement efforts with U.S. consumer plaintiffs in the Starwood Data Security Incident cases and believes it is probable it will incur losses related to those cases. source
• Marriott stated it is reasonably possible it may incur Starwood Data Security Incident losses exceeding recorded amounts, but it could not reasonably estimate the excess amount or range of loss. source
• As of September 30, 2026, Marriott had recorded an accrual for estimated losses related to the Starwood Data Security Incident matters that was not material to its financial statements; Canadian cases remained pending. source
• Marriott stated it was unable to reasonably estimate the total possible financial impact of the Starwood Data Security Incident beyond expenses already recorded, but did not believe the incident would affect its long-term financial health. source