Vermont · verified official-source register

Vermont Privacy Enforcement Cases

3 approved, official-source case records from the 50-state register. Dates, amounts, legal context and disposition qualifications are supported by the cited evidence.

3 primary case-source links · 3 unique primary source URLs

Last editorial review (targeted corrections): · Last link check (automated availability check):

Actual case links

Vermont case register

Each record cites an official Attorney General or state-agency source. Shared multistate amounts should not be summed as unique state penalties. Additional verification sources are identified when an amount has been reconciled.

Verified case 1 of 3

Marriott International, Inc.

Date
2024-10-09
Amount
$52 million to states; Vermont will receive $590,292.25
Legal basis
Vermont’s Consumer Protection Act and Security Breach Notification Act

Why the action was brought

Marriott’s Starwood guest reservation database was breached from July 2014 through September 2018, exposing 131.5 million U.S. guest records, including contact and reservation information, preferences, and some passport and payment-card data. The company allegedly failed to implement reasonable data security and remediate deficiencies while using and integrating Starwood, leading to consumer exposure.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Blackbaud

Date
2023-10-05
Amount
$49.5 million payment to states; Vermont’s share is $3 million
Legal basis
state consumer protection laws, data breach notification laws, and HIPAA

Why the action was brought

Blackbaud’s deficient security and failure to remediate known gaps allowed unauthorized access during a 2020 ransomware event, exposing Social Security numbers, driver’s license numbers, financial information, employment and wealth information, donation history, and protected health information. It allegedly delayed or omitted required notifications and provided incomplete or inaccurate information, affecting over 13,000 customers and more than 15,000 Vermonters.

View Official Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Experian; Experian Data Corp. (EDC); T-Mobile

Date
December 10, 2022
Amount
More than $16 million combined to the states, including $155,652 to Vermont; Experian agreed to pay an additional $1 million; T-Mobile agreed to pay $2.43 million
Legal basis
No statutes or laws cited

Why the action was brought

The settlements addressed 2012 and 2015 Experian data breaches compromising personal information of millions, including 2,133 Vermont consumers. EDC failed to prevent or provide notice of a 2012 breach after an identity thief posing as a private investigator accessed sensitive information. T-Mobile agreed to strengthen vendor oversight.

View Official Case Source ↗ (opens in a new tab)

This register contains approved, official-source privacy, data-breach and data-security enforcement records. Read any case-specific court-approval qualification; inclusion does not confirm payment or final judgment. Shared multistate amounts should not be summed as unique state penalties.

Educational information, not legal advice.

Back to VermontAll states

Original case-library snapshot: August 23, 2026. Original state-law research cutoff: August 25, 2026. Monetary-library update: September 16, 2026, not a new full 50-state research cutoff. Targeted Indiana and New Hampshire law review: October 19, 2026 only. Source inclusion does not independently confirm final court entry or payment.