Maine Hotel Chain Faces Class-Action Lawsuit Over November Data Breach
A Biddeford woman has filed a federal class-action lawsuit against Maine Course Hospitality Group, a Freeport-based hotel chain, after a November 2023 data breach exposed the personal information of over 7,100 individuals, including nearly 4,000 Maine residents.
The breach, disclosed in July 2024 via letters to affected individuals and a report to the Maine Attorney General’s Office, involved unauthorized access to Social Security numbers, government IDs, and health records. The ransomware gang Qilin has claimed responsibility, threatening to release the stolen data unless the company engages with them.
The lawsuit alleges that Maine Course failed to implement adequate security measures and delayed notifying victims, violating state requirements that mandate prompt disclosure unless law enforcement deems it disruptive to an investigation. Under Maine law, companies must notify affected individuals within seven days once an investigation no longer risks interference.
Maine Course Hospitality Group operates over two dozen hotels across New England, primarily under Hilton and Marriott franchises, including locations near Portland International Jetport and in Waterville, Augusta, and Bath. It remains unclear whether the breach impacted hotel guests, employees, or business associates.
The lawsuit seeks class-action certification, a jury trial, and damages, though neither the company nor the plaintiff’s legal team has publicly responded to requests for comment. The case is pending in U.S. District Court in Portland.
Maine Course Hospitality Group cybersecurity rating report: https://www.rankiteo.com/company/maine-course-hospitality-group
"id": "MAI1786041090",
"linkid": "maine-course-hospitality-group",
"type": "Ransomware",
"date": "11/2024",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '7100',
'industry': 'Hospitality',
'location': 'Freeport, Maine, USA',
'name': 'Maine Course Hospitality Group',
'type': 'Hotel Chain'}],
'customer_advisories': 'Letters sent to affected individuals in July 2024',
'data_breach': {'data_exfiltration': 'Threatened by Qilin',
'number_of_records_exposed': '7100',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Social Security numbers',
'Government IDs',
'Health records']},
'date_detected': '2023-11',
'date_publicly_disclosed': '2024-07',
'description': 'A Biddeford woman has filed a federal class-action lawsuit '
'against Maine Course Hospitality Group after a November 2023 '
'data breach exposed the personal information of over 7,100 '
'individuals, including nearly 4,000 Maine residents. The '
'breach involved unauthorized access to Social Security '
'numbers, government IDs, and health records, with the '
'ransomware gang Qilin claiming responsibility.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'lawsuit and delayed disclosure',
'data_compromised': 'Social Security numbers, government IDs, '
'health records',
'identity_theft_risk': 'High',
'legal_liabilities': 'Class-action lawsuit, potential fines for '
'delayed notification'},
'investigation_status': 'Pending',
'motivation': 'Extortion',
'post_incident_analysis': {'root_causes': 'Alleged inadequate security '
'measures'},
'ransomware': {'data_exfiltration': 'Threatened',
'ransomware_strain': 'Qilin'},
'references': [{'source': 'Maine Attorney General’s Office'}],
'regulatory_compliance': {'legal_actions': 'Class-action lawsuit',
'regulations_violated': ['Maine data breach '
'notification law (7-day '
'disclosure requirement)'],
'regulatory_notifications': ['Maine Attorney '
'General’s Office']},
'response': {'communication_strategy': 'Letters to affected individuals and '
'report to Maine Attorney General’s '
'Office'},
'threat_actor': 'Qilin',
'title': 'Maine Hotel Chain Faces Class-Action Lawsuit Over November Data '
'Breach',
'type': 'Data Breach, Ransomware'}