Cadwalader, Wickersham & Taft LLP
MONTH-IN-BRIEF (Oct 2021)
[lwptoc]
Business Litigation
Delaware Court of Chancery Dismisses Caremark Claim Arising from Marriott Cybersecurity Breach
By K. Tyler O’Connell of Morris James LLP
The Delaware Court of Chancery dismissed pursuant to Rule 23.1 derivative claims arising from the hack of roughly 500 million users’ personal data following Marriott’s 2016 acquisition of Starwood Hotels and Resorts—one of the largest hacks ever, an event that spawned lawsuits and governmental investigations. See Fire Ret. Sys. of St. Louis v. Sorenson, et al., 2021 WL 4593777 (Del. Ch. Oct. 5, 2021). Among other things, the stockholder-plaintiff failed to allege with particularity facts showing that a majority of the board of directors consciously disregarded “red flags” showing alleged non-compliance with data privacy norms. “With hindsight knowledge of the extent of the data breach,” the board’s remediation plan was implemented “probably too slow.” Id. at *16. But, the Court reasoned, “the difference between a flawed effort and a deliberate failure to act is one of extent and intent. A Caremark violation requires the plaintiff to demonstrate the latter.” Id. at *19. Accordingly, the Court dismissed the plaintiff’s complaint.