New Hampshire · verified official-source register

New Hampshire Privacy Enforcement Cases

3 approved, official-source case records from the 50-state register. Dates, amounts, legal context and disposition qualifications are supported by the cited evidence.

3 primary case-source links · 3 unique primary source URLs

Last editorial review (targeted corrections): · Last link check (automated availability check):

Actual case links

New Hampshire case register

Each record cites an official Attorney General or state-agency source. Shared multistate amounts should not be summed as unique state penalties. Additional verification sources are identified when an amount has been reconciled.

Verified case 1 of 3

Inmediata Health Group Corp.

Date
March 17, 2025
Amount
$1.4 million, including $25,000 to New Hampshire
Legal basis
New Hampshire Consumer Protection Act, RSA 358-A:2; New Hampshire Data Security Breach Notification Law, RSA 359-C:19 et seq.

Why the action was brought

Inmediata’s website configuration made patients’ electronic protected health information accessible to unauthorized internet users and searchable through Google. The exposed information included names, addresses, dates of birth, medical record numbers, health-insurance information, and medical information, affecting approximately 1.5 million individuals and creating risk of unauthorized disclosure.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Marriott International, Inc.

Date
October 9, 2024
Amount
$52 million; New Hampshire’s share: $1.125 million
Legal basis
New Hampshire Consumer Protection Act, RSA 358-A; New Hampshire data breach notification law, RSA 359-C:20

Why the action was brought

Marriott’s Starwood guest-reservation database was compromised in four incidents between 2014 and 2020, exposing names, addresses, phone numbers, email addresses, passport numbers, dates of birth, gender, loyalty-account information, and reservation details. The states alleged Marriott lacked reasonable safeguards, failed to detect and contain unauthorized access, and delayed breach notifications, increasing consumers’ risks of identity theft and fraud.

View Official Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Carnival Corporation & plc

Date
2025-03-17
Amount
$12.5 million; New Hampshire’s share is not stated
Legal basis
New Hampshire Consumer Protection Act, RSA 358-A:2; New Hampshire data-breach notification law, RSA 359-C:20

Why the action was brought

Carnival experienced multiple data breaches that exposed consumers’ and employees’ personal information. The investigation found that Carnival failed to maintain reasonable data-security practices, adequately protect personal information, detect and respond to incidents, and provide timely notice concerning the breaches, causing potential harm to affected individuals.

View Official Case Source ↗ (opens in a new tab)

This register contains approved, official-source privacy, data-breach and data-security enforcement records. Read any case-specific court-approval qualification; inclusion does not confirm payment or final judgment. Shared multistate amounts should not be summed as unique state penalties.

Educational information, not legal advice.

Back to New HampshireAll states

Original case-library snapshot: August 23, 2026. Original state-law research cutoff: August 25, 2026. Monetary-library update: September 16, 2026, not a new full 50-state research cutoff. Targeted Indiana and New Hampshire law review: October 19, 2026 only. Source inclusion does not independently confirm final court entry or payment.