The Aimbridge Hospitality data breach class action lawsuit addresses an unauthorized intrusion into company email accounts that exposed personal information of current and former employees. Between March 21, 2018, and September 24, 2018, Aimbridge Hospitality, LLC—a major hospitality management company—discovered that cyber attackers had gained access to employee email systems, potentially compromising names, addresses, Social Security numbers, and other sensitive data. The resulting settlement provides affected employees with two years of complimentary credit monitoring services and up to $1,000,000 in identity theft insurance coverage, though Aimbridge has maintained that it bears no legal liability for the breach.
The case, filed in Florida’s 13th Judicial Circuit Court (Case No. 2018-CA-7870) with Arinda Rivera as the class representative, was preliminary approved by the court in November 2019. This settlement is typical of breach litigation in the hospitality industry, where employee data becomes a frequent target for cybercriminals seeking access to personally identifiable information. The coverage provided reflects industry standards for handling data exposure incidents, similar to settlements in other hospitality and corporate sectors where email systems house sensitive employment records.
Table of Contents
- What Happened in the Aimbridge Hospitality Email Breach?
- Credit Monitoring and Identity Theft Insurance Coverage Details
- Settlement Timeline and Court Approval Process
- How to File a Claim and Access Settlement Benefits
- Important Limitations and What the Settlement Does Not Cover
- Aimbridge Hospitality’s Position and Settlement Philosophy
- Data Breach Trends in the Hospitality Industry and Future Outlook
What Happened in the Aimbridge Hospitality Email Breach?
Aimbridge Hospitality discovered unauthorized access to its employee email accounts during two separate incidents in 2018. The first intrusion was identified on or about March 21, 2018, and a second unauthorized access was detected on September 24, 2018. The company operates as a leading hospitality management firm overseeing hotel properties across multiple brands and locations, meaning thousands of employees had information stored in these compromised email systems.
While the exact number of affected individuals was not disclosed in settlement documents, the scope of the breach was significant enough to warrant a company-wide notification and class action litigation. The unauthorized access gave cyber attackers potential exposure to employee personal information stored in or transmitted through email, including names, addresses, dates of birth, Social Security numbers, and employment records. Unlike breaches that affect customer data, this incident directly exposed workers who depended on the company for employment and benefits information. The discovery process took several months, which is common in email breach cases where forensic investigation is required to determine the full scope of compromise and identify all potentially affected individuals.
Credit Monitoring and Identity Theft Insurance Coverage Details
The Aimbridge Hospitality settlement provides two primary forms of protection for affected class members. First, eligible individuals receive two years of complimentary credit monitoring through myTrueIdentity services, which monitors activity on TransUnion credit reports. This type of monitoring helps detect unauthorized attempts to open new accounts, make purchases, or take out loans in victims’ names—a common consequence of identity theft following data breaches. However, single-bureau monitoring has a significant limitation: it only covers TransUnion credit files and does not monitor Equifax or Experian, meaning fraudsters could still use stolen information to commit identity fraud tracked by the other two major credit bureaus.
Beyond credit monitoring, the settlement includes $1,000,000 in identity theft insurance per class member. This coverage can reimburse individuals for expenses related to identity theft recovery, such as legal fees, document replacement costs, and lost wages from time spent resolving fraud issues. It’s important to note that while this insurance amount is substantial, it applies only to documented losses from identity theft that occurs after the breach discovery. Individuals must file claims and provide proof of identity theft-related expenses to access reimbursement; the insurance does not automatically compensate class members simply for the data exposure itself.
Settlement Timeline and Court Approval Process
The settlement process for the Aimbridge Hospitality breach followed the standard path for data breach class actions. The court set an objection deadline of November 18, 2019, giving class members the opportunity to formally object to the proposed settlement terms if they believed the compensation was inadequate. A settlement hearing was scheduled for November 21, 2019, where the court would hear arguments from all parties and determine whether the settlement met legal requirements for fairness, adequacy, and reasonableness. At that hearing, the court granted preliminary approval to the settlement, allowing the administration process to begin.
Preliminary approval is not the final step in class action settlements. Even after preliminary approval, the settlement must receive final court approval following the claims period and any appeals. Aimbridge’s position throughout the case has been consistent: the company denies wrongdoing and admits no liability, meaning the settlement represents a business decision to resolve the litigation rather than an admission that the company failed in its security duties. This denial of liability is fairly common in data breach settlements, as companies often choose to settle to avoid prolonged litigation costs and reputational exposure, regardless of fault determinations.
How to File a Claim and Access Settlement Benefits
Affected employees of Aimbridge Hospitality who worked for the company during the breach periods are eligible to claim benefits under the settlement. To receive the two years of free credit monitoring and access the identity theft insurance, individuals must submit a claim through the official settlement administrator. The claims process typically requires basic identifying information to verify employment and confirm eligibility during the breach timeframe. Some settlements allow claims to be filed online, by mail, or through the settlement website, though the specific procedures for the Aimbridge settlement should be verified through the official settlement portal.
A key limitation of the settlement is that class members must proactively claim their benefits—the coverage does not apply automatically. Individuals who do not file a claim by the deadline will forfeit their eligibility for credit monitoring and identity theft insurance. This is a critical distinction compared to settlements that automatically enroll all class members; in this case, failure to take action means losing protection. The settlement administrator typically extends claim deadlines to accommodate reasonable requests, so individuals who miss the initial deadline may still be able to submit late claims with proper documentation, though this depends on the settlement terms and administrator discretion.
Important Limitations and What the Settlement Does Not Cover
While the settlement provides meaningful protections, it has significant boundaries that affected employees should understand. The two years of credit monitoring is time-limited; after 24 months, the free service expires and individuals must decide whether to pay out-of-pocket for continued monitoring or rely on other resources. Additionally, single-bureau monitoring creates gaps in protection, as fraudsters may exploit the information using credit bureaus that are not being monitored. For individuals concerned about long-term identity theft risk, supplementary monitoring from other sources may be necessary after the settlement monitoring expires.
Another important limitation is that the identity theft insurance requires documentation of actual financial losses before reimbursement occurs. The $1,000,000 coverage limit does not represent a payment to each class member; rather, it’s a pool of insurance available to cover documented expenses. Class members must file claims demonstrating specific costs incurred due to identity theft, such as lawyer fees for fraudulent account disputes, expenses replacing stolen identity documents, or wages lost while resolving fraud issues. Psychological harm, stress, or general inconvenience from the breach itself are typically not reimbursable under identity theft insurance. Also, any identity theft that occurred before the claim is filed may not be covered, depending on insurance policy language.
Aimbridge Hospitality’s Position and Settlement Philosophy
Throughout the litigation, Aimbridge Hospitality maintained that it “denies that it has done anything wrong or illegal and admits no liability” for the breach or its consequences. This stance reflects a common defense strategy in data breach litigation, where companies attempt to separate business settlement decisions from legal fault. By settling preliminary and proceeding toward final approval, Aimbridge avoided prolonged discovery costs, jury trial expenses, and potential larger damage awards, while also avoiding a public determination of negligence in its security practices. This is typical in the hospitality industry, where companies frequently face breach litigation related to IT infrastructure vulnerabilities.
The settlement reflects what many legal experts consider a reasonable middle ground in breach cases. Class members receive concrete benefits—credit monitoring and identity theft insurance—without the company admitting formal legal wrongdoing. From a practical standpoint, class members gain immediate protections regardless of liability determinations, while Aimbridge resolves its legal exposure. For affected employees, the focus should be on claiming available benefits rather than pursuing the question of corporate fault, as the settlement provides clear remedies independent of liability findings.
Data Breach Trends in the Hospitality Industry and Future Outlook
The Aimbridge Hospitality breach represents a broader pattern of cybersecurity vulnerabilities in the hospitality sector. Email systems are frequent targets for attackers because they contain a concentration of personal, financial, and operational data. Hotel management companies like Aimbridge employ thousands of staff across numerous properties, creating large networks where a single compromised email account can cascade into broader system access. As the hospitality industry becomes increasingly digitized—from reservation systems to payroll and benefits management—the risk of employee data exposure continues to grow.
Looking forward, data protection standards in hospitality are expected to tighten through regulatory changes and industry best practices. Many states have now adopted data breach notification laws requiring prompt disclosure to affected individuals, and the hospitality sector is gradually implementing stricter security protocols for employee data. For current and future employees in this industry, the lesson from the Aimbridge settlement is that proactive credit monitoring, regular identity checks, and awareness of personal information stored in corporate systems are essential protective measures. The settlement provides a window of protection, but individuals should also maintain their own long-term vigilance regarding their credit and identity security.
Sources
- Aimbridge Hospitality Tobacco and Wellness Surcharge Investigation — investigation page, including who is still being signed up, from our sister site OpenClassActions.com.
You Might Also Like
- Wynn Resorts Employee Data Breach Class Action
- Tyler Technologies Ransomware Data Breach Class Action
- Trinity Health Ransomware Data Breach Class Action
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: