Maine Course Hospitality Group Sued Over 8-Month Data Breach Notification Delay
A class action lawsuit alleges the hotel management company waited until July 2026 to notify 7,108 victims of a sensitive data leak.
Maine Course Hospitality Group is facing a class action lawsuit in the U.S. District Court for the District of Maine following a data breach that exposed the personal information of thousands. The legal action centers on allegations that the company failed to notify victims in a timely manner, leaving sensitive data vulnerable for months.
According to court filings, the breach impacted 7,108 individuals, including 3,989 residents of Maine. The compromised data was highly sensitive, including names, Social Security numbers, and health information. While the breach occurred in early November 2025, notification letters were not dispatched to the affected parties until July 31, 2026—a delay of approximately eight to nine months.
Based in Freeport, Maine, Maine Course Hospitality Group manages a portfolio of premium brand and independent hotels across New England and New York City, including the Courtyard by Marriott in Portland's Old Port. The breach was linked to a ransomware attack carried out by the threat actor group known as Qilin, which was first reported on November 5, 2025.
This case underscores the severe legal and financial risks companies face when they delay data breach disclosures. By waiting nearly nine months to inform victims, the company is alleged to have violated Maine's data breach laws. For the victims, this window of silence meant that Social Security numbers and health data remained exposed without their knowledge, significantly increasing the risk of identity theft and financial fraud.
Industry experts note that prompt notification is critical for mitigation. When victims are unaware of a leak, they cannot freeze their credit or monitor their accounts, effectively neutralizing the utility of the identity protection services that companies often offer after the fact. In response to the incident, Maine Course Hospitality Group is providing affected individuals with one year of complimentary credit monitoring and identity protection services.
The lawsuit now moves through the U.S. District Court in Portland, where the court will determine if the company's notification timeline constituted a legal breach of duty. The outcome could set a precedent for how strictly Maine's notification laws are enforced against hospitality firms. Affected individuals are encouraged to utilize the offered monitoring services while the litigation proceeds.