CHOICE HOTELS INTERNATIONAL, INC. Data Breach — Official Case File

From the AG filing description

Choice Hotels International, Inc. stands as one of the world's largest lodging franchisors, operating a vast portfolio of well-known hotel brands across the globe. To facilitate seamless guest reservations, loyalty reward programs, and operational management, the company collects, processes, and stores vast quantities of sensitive consumer and employee data. This information typically includes extensive personally identifiable information, payment card details, passport data, and detailed travel itineraries. Because millions of consumers rely on Choice Hotels for travel accommodations year-round, the organization maintains centralized digital databases containing high-value consumer assets, making it an inevitable and lucrative target for cybercriminal syndicates. In 2026, Choice Hotels International, Inc. officially reported a significant security incident to the Illinois Attorney General, joining a growing wave of major hospitality enterprises targeted by sophisticated threat actors. While investigations into such breaches frequently center on unauthorized access to corporate networks, third-party vendor compromises, or credential-stuffing attacks, incidents of this magnitude typically highlight vulnerabilities in network perimeter defenses or legacy reservation systems. Attackers routinely exploit these weaknesses to bypass security controls, dwelling undetected within corporate environments for weeks or months to exfiltrate vast repositories of confidential consumer and personnel files before deploying ransomware or locking down infrastructure. The exposure resulting from a major hospitality breach poses severe, multi-faceted risks to affected guests and personnel. Compromised data fields frequently include full names, residential and email addresses, phone numbers, dates of birth, encrypted or unencrypted payment card information, and loyalty account credentials. When payment card data and personal identifiers are leaked simultaneously, victims face an immediate threat of fraudulent credit card charges and unauthorized financial account takeover. Furthermore, leaked loyalty account points and personal profiles can be exploited by bad actors to commit secondary identity theft, compromise personal email accounts, or execute targeted phishing campaigns designed to siphon additional financial resources from unsuspecting consumers. As a major commercial entity operating across state lines and internationally, Choice Hotels International, Inc. is bound by stringent legal obligations to safeguard the sensitive consumer data entrusted to its care. Under state consumer protection statutes, such as the Illinois Consumer Fraud and Deceptive Business Practices Act, as well as general negligence principles and Federal Trade Commission standards, corporations have an affirmative duty to implement and maintain reasonable data security measures. The occurrence of a widespread data breach strongly indicates a potential failure of these foundational legal duties, including deficiencies in network encryption, inadequate access controls, or a failure to promptly patch known software vulnerabilities, which directly facilitated the unauthorized extraction of private information. Receiving a formal data breach notification letter from Choice Hotels International, Inc. carries significant legal implications for affected individuals, serving as an admission by the company that your confidential records were compromised due to inadequate security infrastructure. Under contemporary legal standards, the receipt of such a notification often establishes the requisite legal standing to participate in class action litigation aimed at holding negligent corporations accountable. Importantly, affected consumers do not need to prove that financial fraud has already occurred to seek legal redress; the increased risk of future identity theft and the loss of privacy are actionable harms. Our firm evaluates these data breach cases on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront legal fees unless we successfully recover compensation on your behalf.