Freeport Hospitality Group Faces Class-Action Lawsuit Over Delayed Data Breach Notification Maine Course Management Company, a Freeport-based hospitality group operating 28 hotels across New England including 14 in Maine has reported a data breach that may have exposed sensitive personal information. The incident, disclosed to the Maine Attorney General’s Office, compromised names, Social Security numbers, and state ID numbers of 7,194 individuals, with 3,954 of those affected being Maine residents. The breach occurred on October 31, 2023, and was detected the following day. However, victims were only notified via mail on July 31, 2024 a delay of nearly nine months. State guidelines require breach notifications to be sent "without unreasonable delay," with exceptions only if law enforcement determines that disclosure could hinder an investigation. Even in such cases, notices must be issued within seven days of receiving clearance. On July 30, 2024, a federal class-action lawsuit was filed in Portland, alleging that Maine Course Management failed to implement adequate cybersecurity safeguards and unreasonably delayed notifying affected individuals. The company has not yet responded to requests for comment.

Maine Hospitality Company Faces Class-Action Lawsuit Over 2025 Data Breach Maine Course Hospitality Group, a company managing hotels across Maine, New England, and New York including Portland’s Courtyard by Marriott is the target of a proposed class-action lawsuit following a cyberattack that exposed the personal data of over 7,100 individuals. The breach, discovered in November 2025, compromised sensitive information, including names, Social Security numbers, and driver’s license details. Of those affected, 3,989 were Maine residents. The company filed a data breach notice with the Maine Attorney General’s Office last week, nearly nine months after detecting the incident. The lawsuit, filed in U.S. District Court in Maine, alleges the company failed to secure customer data and violated Maine’s data breach notification law, which requires prompt disclosure typically within 30 days of discovery. The plaintiff seeks class-action status, damages, and other relief for those impacted. In response, Maine Course Hospitality Group is offering one year of free credit monitoring and identity protection services to affected individuals. The company has not publicly commented on the lawsuit or breach.

Maine Course Hospitality Group Data Breach Exposes Sensitive Information of 553 Vermont Residents Maine Course Hospitality Group, a Freeport, Maine-based hotel management company, disclosed a data breach that compromised the personal and health information of at least 553 Vermont residents. The incident came to light after the ransomware group Qilin claimed responsibility on November 5, 2025, posting stolen data on the dark web via the Tor network. The exposed data included government ID numbers, Social Security numbers, and health records, raising significant privacy and security concerns. The breach was officially reported to the Vermont Attorney General on July 31, 2026. Maine Course Hospitality Group has begun notifying affected individuals, providing details on the compromised data and offering protective services. Those who receive a breach notification letter are advised to review it carefully, follow enrollment instructions for support, and retain the document for their records. Additional information is available through the company’s website or direct contact.

Maine Hotel Chain Faces Class-Action Lawsuit Over November Data Breach A Biddeford woman has filed a federal class-action lawsuit against Maine Course Hospitality Group, a Freeport-based hotel chain, after a November 2023 data breach exposed the personal information of over 7,100 individuals, including nearly 4,000 Maine residents. The breach, disclosed in July 2024 via letters to affected individuals and a report to the Maine Attorney General’s Office, involved unauthorized access to Social Security numbers, government IDs, and health records. The ransomware gang Qilin has claimed responsibility, threatening to release the stolen data unless the company engages with them. The lawsuit alleges that Maine Course failed to implement adequate security measures and delayed notifying victims, violating state requirements that mandate prompt disclosure unless law enforcement deems it disruptive to an investigation. Under Maine law, companies must notify affected individuals within seven days once an investigation no longer risks interference. Maine Course Hospitality Group operates over two dozen hotels across New England, primarily under Hilton and Marriott franchises, including locations near Portland International Jetport and in Waterville, Augusta, and Bath. It remains unclear whether the breach impacted hotel guests, employees, or business associates. The lawsuit seeks class-action certification, a jury trial, and damages, though neither the company nor the plaintiff’s legal team has publicly responded to requests for comment. The case is pending in U.S. District Court in Portland.