page contents

Hacker’s malware data breach at French Lick resort

Hacker’s malware data breach at French Lick resort

There is a clear and present danger of hackers obtaining hotel guests’ private information.

In this week’s article, we discuss the recent case of Alonso and Hardt v. Blue Sky Resorts, LLC, 2916 WL 1535890 (S.D. Ind. 2016) in which plaintiffs, hotel guests, respectively, at “Blue Sky’s West Baden Springs Hotel” and “Blue Sky’s French Lick Spring Hotel” sought to represent a class of hotel guests seeking damages arising from “a data breach committed by hackers who had installed a malware program on one of the servers on French Lick Resort’s point of sale system”. This case is instructive of the clear and present danger of hackers obtaining hotel guests’ private information. We examined this issue in Dickerson, The Wyndham data breach case: Lessons to be learned in cybersecurity, (9/16/2015).

Travel Terror Update


In Amendral, Rodrigo Duterte, Scorned Abroad, Remains Popular in the Philippines, (10/13/2016) it was noted that “Since he took office in June promising to kill drug addicts and dealers, about 1,400 people have been killed by the police in antidrug operations, and hundreds more by vigilantes. His embrace of violence has shocked over countries and brought condemnation from human rights groups”.

Zika, Zika, Zika

In Tavernise, A New Zika Zone in Miami, but no Reason to Panic, Scientists Say, (10/13/2016) it was noted that “Florida announced a new Zika transmission zone on Thursday, saying that the virus had popped up in the mile-square patch of northern Miami and that five people had been infected. The area, around the Little Haiti neighborhood, from NY 79th Street in the north to NW 63rd Street in the South…The five people who contracted Zika locally were two women and three men”.

In Ceinture, One Family’s Struggle With Microcephaly, the Birth Defect New Linked to Zika, (10/17/2016) it was noted that “Ms. Grounds, a 45-year-old psychotherapist, and her husband, Jon Mir, who live in Manhattan, had no idea what microcephaly would mean from them or for their child…As mosquito season draws to a close in much of the country, taking with it the major risk of new Zika infections, there are still more than 2,600 pregnant women who have tested positive for the virus in the United States and its territories…They and thousands more around the world, face the prospect of giving birth to a child with microcephaly”.

Air Travel Emissions

In Fountain, over 190 Countries Adopt Plan to Offset Air Travel Emissions, (10/6/2016) it was noted that “Governments from more than 190 countries on Thursday adopted a measure that for the first time will reduce the climate impact of international jet travel…The aviation plan, the product of years of negotiations, was approved by acclamation at a meeting of the International Civil Aviation Organization, or I.C.A.O., in Montreal. The measure could force air carriers to take major steps to improve fuel economy in their routes and fleets, very likely accelerating the purchase of newer, more efficient planes. Carriers may pass the cost of the program on to consumers in higher airfares, though most experts think any increase would be relatively small… (The accord) will take effect in 2021, as a major step in reducing the environmental impact of international aviation which is currently responsible for about 2 percent of worldwide emissions of greenhouse gases”.

Samsung Galaxy Note 7 Banned

In Jansen, Samsung Galaxy Note 7 banned on all U.S. flights due to fire hazard, (10/16/2016) it was noted that “Samsung Galaxy Note 7 phones will be banned from all airline flights after nearly 100 incidents of the devices overheating and sometimes injuring owners, the Transportation Department announced Friday. The (FAA) previously urged travelers not to turn on the phones, pack them in checked baggage or charge them during a flight. The new ban is effective at noon Saturday”.

Tourists Behaving Badly

In Tatlow, Tourists Behaving Badly: Name-and-Shame Effort Fails to Fix China’s Image, (10/10/2016) it was noted that “Two young Chinese tourist carve their names on the Great Wall. Hundreds of picnickers leave their garbage on the banks of the Yellow River. Such episodes during the recent National Day holiday have produced a flurry of photographic postings and a spasm of soul-searching in China, highlighting anxieties over the habits and image of tourists at home and abroad in a nation that is increasingly cash-rich but, some say, short on manners and experience with the outside world. They are also raising questions as to why a ‘tourism blacklist’, the government set up last year to name and shame misbehaving travelers does not seem to have had a greater impact. In May 2015, to counter the impression left by an array of widely publicized episodes that have included travelers storming a buffet in Thailand to consumer all the prawns, throwing hot water at a flight attendant, carving inscriptions on an ancient Egyptian monument, allowing children to relieve themselves in public places and opening emergency exist on airliners ‘for fresh air’, the government announced the blacklist”.

Honest Travel Reviews?

In Gulliver Business Travel, Hotels Are Overrated, Reviews on travel websites are rarely honest, (6/17/2016) it was noted that “Howe honest are reviews on travel websites? By this I do not mean: is the person writing the review who he says he is, and not the owner of the hotel boosting its rating on a competitor doing it down?… I mean, rather, to what extent are reviewers’ ratings a reflection of their actual experience?… In fact, many of us feel compelled to inflate the marks we leave online. Over half…of the reviews for electrical products on Amazon, for example, are five-star…That top mark should be reserved for something exceptional. And that does not apply to lover half of people’s experiences. But in reality, for most reviewers, the top mark means nothing more than ‘good’; four is akin to ‘nothing terrible happened to me’. Hence, good ratings are nearly always one mark too high; bad ones one too low. Indeed, as both the Amazon and Trip advisor research shows, very few people leave a three-star review, which would be the median score in an honest world…That is not a problem as long as everyone knows the rules of the game. And, as we have written before…the fact that we can all now review the places we stay in is probably the single most important reason why service levels have risen. Checking out online what others think of a hotel is now so common that there is no place for the substandard places to hide”.

Carnegie Deli Closes

In Feldman, The End of the Carnegie Deli, a True New York Tourist Trap, New York Magazine (October 2016) it was noted that “Even from the street, the Carnegie Deli looks like a New York institution. There’s the sign-that famously florid, curlicue ‘Carnegie’-and the line of people that often stretches down the block…Inside, the room doesn’t disappoint: Heaving cheesecakes crowd the refrigerator case, celebrity head shots are all over the walls and oversize sandwiches are on every table. It’s always loud and its always crowded…But at the end of the year, after an eight-decade run, the Carnegie Deli will close for good”.

FAA Proposes $78,000 Fine

In FAA proposes $78,000 fine against Amazon, (10/11/2016) it was noted that “The U.S. Department of Transportation’s Federal Aviation Administration (FAA) proposes a $78,000 civil penalty against Inc. For allegedly violating the Hazardous Materials Regulations. The FAA alleges that on August 7, 2015 Amazon offered FedEx an undeclared shipment containing a flammable liquid for air transportation from Ruskin, Fla. To Algonquin, Ill”.

FAA Delayed Baggage Refunds

In Yamanouchi, Feds will require airline baggage fee refunds when bags are delayed, airport/blog.ajc/com (7/27/2016) it was noted that “A new measure signed into law this month will require airlines to refund baggage fees when bags are delayed… The measure in a (FAA) re-authorization extension bill signed into law this month directs the U.S. Transportation Secretary to issue regulations on the matter within a year. The new regulations would require an airline to ‘promptly provide a passenger an automated refund for any ancillary fees paid by the passenger for checked baggage’ if the bag is not delivered within 12 hours of arrival of a domestic flight, or within 15 hours of arrival of an international flight. The passenger would need to notify the airline of the lost or delayed baggage to get the refund”.

Reports On Cruise-Ship Crime

In Anglen, Travelers can now get 1st comprehensive reports of cruise-ship crime, (10/6/2016) it was noted that “Oceangoing travelers for the first time can see what crimes are being reported aboard ships in U.S. ports-and the numbers compared with last year could make some of them seasick…The number of reported sexual assaults on cruise ships jumped 550% in the first six months of 2016, going to 39 from six in 2015. Overall, reported crimes on ships jumped 408% to 61 from 12. The dramatic increase doesn’t mean cruise ships are more dangerous or violent that they were last year. But now, the public has access to reports of onboard crimes compiled by the U.S. Department of Transportation that were not available in years past. ‘The disclosure of crimes and the FBI follow-up, are the most significant things we’ve accomplished’ said…Kendall Carver, founder and Chairman of the International Cruise Victims Association, which has been fighting for a decade for passenger safety”.

Blood Ivory Seized In Vietnam

In After CITES fails African Elephants are two shipments of blood ivory seized in Vietnam, (10/9/2016) it was noted that “300 kilograms of ivory just a few days ago and now over half a ton of blood ivory yesterday is the haul of vigilant customs and security officers at both Ho Chi Minh City and the airport of Hanoi, both shipments coming from Africa with at least one identified as originating from Mozambique. Vietnam, as are China and a handful of other South and Far Eastern countries, are the main destinations for the shipment of blood ivory as domestic ‘consumption’ remains high under domestic laws which have failed to ban the possession, processing and trade of any form of ivory products”.

Travel Law Article: The Alonso & Hardt Case

In the Alonso & Hardt case the Court noted that “Blue Sky owns and operates the French Lick Resort located in Southern Indiana. Alonso, a resident of Indiana, stayed at Blue Sky’s West Baden Springs Hotel…and paid for her room with her credit card. Hardt, a resident of Kentucky, stayed at Blue Sky’s French Lick Springs Hotel (and) paid for room with her credit card”.

Malware Data Breach

“On January 19, 2015, Blue Sky leaned that it had suffered a data breach committed by hackers who had installed a malware program on one of its servers on French Lick Resort’s point of sale system. This malware allowed the hackers to periodically obtain certain credit information from some, but not all, of the resort’s customers who had used their credit cards at the resort-specifically the names, credit card numbers and card expiration dates were stolen”.

Notice To The Police

“Upon discovering the date beach, Blue Sky immediately provided information to law enforcement authorities and employed a specialized computer technology team to investigate, isolate and eliminate the malware. The concealment of the malware was so sophisticated that it was undetected by these experts for several days. An internal investigation revealed that the malware had been installed on the point of sale system on April 23, 2014 and it was not disabled until January 21, 2015, two days after the first notification of a data breach”.

Warning Its Customers

“Starting on January 26, 2015, Blue Sky provided notification of the data breach to its customers by sending letters directly to them. Additionally, starting on January 26, 2015, Blue Sky began notifying the Attorneys General in fifteen states, including Indiana. On January 27,2015, Blue Sky provided notification to major news publications in the affected areas, established a call venter for customer inquiries and concerns, established free credit card monitoring services with Experian for customers and established insurance coverage for identity theft situations arising out of the data breach up to $1 million per credit card number. Customers also were encouraged to carefully monitor their credit card statements for unauthorized transactions and were advised to cancel their credit cards and request replacement cards”.

What Are The Damages?

“According to the Third Amended Complaint Alonso’s credit card was replaced in January 2015 and Hardt’s credit card was replaced in June 2014. Alonso and Hardt each suffered damages as a result of Blue Sky’s inability to safeguard their personal data. Specifically, Alonso was delinquent in her automatic credit card payment to her AT&T account when her credit card was cancelled due to the data beach and she spent over an hour of her time changing various automatic credit card payment set ups. Hardt also spent over an hour of her time researching and signing up with a credit card monitoring service for which she is being charged $8.49 per month. Neither Alonso nor Hardt have alleged or offered any evidence that their credit information was actually used, resulting in any fraudulent transactions on their accounts”.

The Class Described

“Alonso and Hart allege that there is a class of others similarly situated who had their personal information stolen…Plaintiffs allege that they, and the purported class members, were overcharged for their purchase of products and services at the French Lick Resort in that a portion of the purchase price was dedicated to ensuring that customers were protected and safeguarded from data breaches”.

Do Plaintiffs Have Standing?

“Blue Sky argues that Plaintiffs have failed to establish Article III standing (as articulated by the U.S. Supreme Court) First, the plaintiff must have suffered an ‘injury in fact’-an invasion of a legally protected interest which is (a) concrete and particularized and (b) ‘actual or imminent, not ‘conjectural’ or ‘hypothetical’, Second, there must be a causal connection between the injury and the conduct complained of…Third, it must be ‘likely’ as opposed to merely ‘speculative’ that the injury will be ‘redressed by a favorable decision’”.

No Injury, No Case

“Blue Sky explains that Plaintiffs have not suffered or alleged an actual concrete injury or a certainly impending injury that would establish standing because Alonso and Hardt fail to present any allegations that their credit card accounts ever had any fraudulent charges made on them, let alone that if any such unauthorized charges occurred, they were not reimbursed or were cancelled by their credit card companies. Blue Sky notes that neither plaintiff alleges that her credit card information was actually obtained by the hackers’ malware…Blue Sky further points out that neither Alonso nor Hardt have presented any factual allegations that anyone has actually impersonated them or otherwise stolen their identities, for example, to obtain passports, driver licenses, immigration status, medical benefits, government benefits, or tax return refunds, to secure a job or to procure housing. There are no allegations that Plaintiffs’ social security numbers were ever provided to the resort”.


“The Court determines that Plaintiffs lack Article III standing because they have not alleged nor suffered a concrete, particularized injury. Additionally, they cannot demonstrate that any future injury they fear is certainly impending and they cannot manufacture standing by incurring costs in anticipation of a non-imminent harm. Because Plaintiffs lack Article III standing, dismissal in appropriate”.

Justice Dickerson has been writing about travel law for 39 years including his annually updated law books, Travel Law, Law Journal Press (2016) and Litigating International Torts in U.S. Courts, Thomson Reuters WestLaw (2016), and over 400 legal articles many of which are available at Justice Dickerson is also the author of Class Actions: The Law of 50 States, Law Journal Press (2016). For additional travel law news and developments, especially in the member states of the EU, see

This article may not be reproduced without the permission of Thomas A. Dickerson.

Read many of Justice Dickerson’s articles here

Tagged with