Previously published on Business Law Today

Fire Ret. Sys. of St. Louis v. Sorenson, et al., 2021 WL 4593777 (Del. Ch. Oct. 5, 2021).

The Delaware Court of Chancery dismissed pursuant to Rule 23.1 derivative claims arising from the hack of roughly 500 million users’ personal data following Marriott’s 2016 acquisition of Starwood Hotels and Resorts – one of the largest hacks ever, an event that spawned lawsuits and governmental investigations. Among other things, the stockholder-plaintiff failed to allege with particularity facts showing that a majority of the board of directors consciously disregarded “red flags” showing alleged non-compliance data privacy norms. While “[w]ith hindsight knowledge of the extent of the data breach,” the board’s remediation plan was implemented “probably too slow.” Id. at *16. But, the court reasoned, “the difference between a flawed effort and a deliberate failure to act is one of extent and intent. A Caremark violation requires the plaintiff to demonstrate the latter.” Id. at *19. Accordingly, the court dismissed the plaintiff’s complaint.