Colorado Privacy Enforcement Cases

Why the action was brought

23andMe’s 2023 credential-stuffing data breach compromised genetic and other customer data of 6.9 million consumers worldwide, including 140,517 Coloradans; some genetic ancestry information was published for sale on the dark web. The multistate investigation found unreasonable data-security practices, including delayed discovery, initial denial, and refusal to accept responsibility.

Why the action was brought

Marriott’s Starwood guest reservation system breach exposed 131.5 million U.S. guest records, including contact, gender, birth-date, reservation, stay-preference, limited unencrypted passport, and unexpired payment-card information. Intruders remained undetected from July 2014 through September 2018; Marriott acquired Starwood in 2016 but failed to diagnose and disclose the breach until years later, violating consumer and personal-information protection laws.

Why the action was brought

Blackbaud’s 2020 ransomware breach exposed contact and demographic information, Social Security and driver’s-license numbers, financial and employment information, donation history, and protected health information. The company allegedly failed to implement reasonable security, remediate known gaps, and provide customers timely, accurate notifications, causing significantly delayed or absent consumer notifications and misleading customers about notification requirements.