Maine-based hotel chain sued for data breach affecting thousands
Company executives Kevin Pagnano, Jonathan Bogatay, Peter Anastos and Sean Riley stand outside Maine Course Hospitality Group offices in Freeport in 2024. (Brianna Soukup/Staff Photographer)
A Biddeford woman has filed a federal class-action complaint against a Maine-based hotel chain after her private information was stolen by cybercriminals in a data breach last November affecting more than 7,100 people.
Maine Course Hospitality Group, a Freeport company with hotels across New England, sent “notice of data incident” letters dated July 31 to Erica Cote and others who were affected by the breach, according to a lawsuit filed Tuesday in U.S. District Court in Portland.
The company also reported the security breach to the Office of the Maine Attorney General on July 31, stating that it occurred Nov. 1 and affected 7,194 people, including 3,954 Maine residents.
Investigations determined that “bad actors” had accessed Social Security numbers, government ID numbers and health records belonging to Cote and other potential class members, the lawsuit states.
A ransomware gang known as “Qilin” has claimed responsibility for the data breach in a blog post that states: “The full dump of sensitive data will be released if Maine Course Hospitality Group does not initiate contact with us immediately,” according to the lawsuit.
Related
Maine company wants to create a new American hotel chain
Because Maine Course stored and handled highly personal information in connection with providing its services, “it had a duty and obligation to safeguard this information and prevent unauthorized third parties from accessing this data,” the lawsuit states.
Advertisement
It’s unclear whether Cote and other potential class members were hotel guests, employees or business associates.
Lawyers for the parties didn’t respond immediately to requests for interviews.
The lawsuit charges that Maine Course failed to implement “reasonable security protections” to safeguard its information systems and “unreasonably delayed” notifying victims of the breach.
It seeks certification as a class action, a jury trial and damages.
According to the attorney general’s website, notifications of cyberattacks must be made “without delay.” However, if a company is pursuing a criminal investigation, notices may be delayed until they will no longer interfere with information gathering.
“Once law enforcement determines the notice will not compromise the investigation, the notice should be made within 7 days,” the website states.
Maine Course Hospitality Group owns and manages about two dozen hotels in New England, plus a couple in Florida and North Carolina. Most are Hilton and Marriott franchises, including Courtyards near the Portland International Jetport and in the Old Port, as well as Hampton Inns in Waterville, Augusta, Bath, Freeport and Thomaston.
Copy the Story Link
Tagged: cybersecurity, data breach, freeport maine, hospitality industry, hotels, maine businesses
Kelley writes about Maine businesses large and small, focusing on economic development, workforce initiatives and the state’s leading business organizations. Her wider experience includes municipal and. More by Kelley Bouchard
