Newsroom

The Bank of Louisiana is leading a class-action lawsuit on behalf of banks and other financial institutions in the wake of the Marriott International data breach that revealed personal information – including names, addresses, payment card details and passport numbers – of as many as 500 million customers.

Marriott was informed in September of a breach that impacted its Starwood guest reservation database. On Nov. 19, the company determined there had been unauthorized access to the data going back to at least 2014.

In the lawsuit filed with the U.S. District Court for the District of Maryland, Bank of Louisiana argues that Marriott had inadequate data security measures and that the bank – and other financial institutions that issued cards compromised in the breach – incurred costs related to reissuing cards, refunding unauthorized transactions caused by the breach, increasing fraud monitoring efforts and responding to higher numbers of complaints and inquiries.

Following news of the data breach, NAFCU urged leaders of the Senate Banking and House Financial Services Committees to take action on a national data security standard, noting that this Marriott breach is one of the largest breaches of personal data.

NAFCU has long been active with lawmakers on this issue, and was the first group after the massive 2013 Target data breach to call for a legislative solution to reform the nation's data security system. The association is currently engaged as Congress considers a bill that would require data breach notifications for financial entities akin to what is in place for financial institutions under the Gramm-Leach-Bliley Act.

NAFCU continues to share with Congress credit unions' principles for data security. The association last week sent a letter to House leaders on the issue following the release of a House Oversight and Government Reform Committee report on the Equifax data breach, which determined that the incident could have been prevented.