Harrisburg, Pennsylvania – The Pennsylvania Attorney General, along with attorneys general from 26 other states, has reached a settlement with Saber Corporation for a 2017 privacy breach for $ 2.4 million. The breach collected data from an online hotel booking company’s reservation system, which revealed information from 1.3 million credit cards.
Pennsylvania will receive $ 85,483.13 plus an injunction from the settlement.
“Businesses are responsible for protecting their customers’ private information from being browsed, and Saber has failed to do that,” said AG Shapiro. “This deal will serve as a model for other companies and prevent future data breaches. My office will continue to hold companies accountable for failing to protect their customers’ personal information. “
Saber Hospitality Solutions, a division of Saber, operates the SynXis Central Reservation System for processing hotel reservations. SynXis connects business travel coordinators, travel agents and online travel booking companies on the one hand with Saber hotel customers on the other.
On June 6, 2017, Saber informed its hotel customers about a data breach between August 2016 and March 2017 that the company had disclosed in an SEC filing the previous month. Hotels have sent notifications to customers, but some notifications weren’t released until 2018, and some customers have received multiple notifications regarding the same data breach.
According to the Dec. 23 settlement, Saber must implement and maintain a comprehensive security program. a written incident response and data breach notification plan; specific security requirements; Third party security assessments; and other measures, including submitting a list of notified clients to the 27 attorneys-general involved in the lawsuit.
Attorney General Shapiro included the attorneys general of Vermont, Arkansas, Connecticut, Illinois, Alaska, Arizona, Florida, Hawaii, Indiana, Iowa, Louisiana, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, New Jersey, New Jersey York, North Carolina , North Dakota, Ohio, Oregon, Tennessee, Virginia and Washington.