Choice Hotels Data Breach Lawsuit: Franchisees, Not Hotel Guests
Active Litigation
The headline “Choice Hotels negligent in data breach” is about a January 14, 2026 intrusion into an internal Choice application that held records on franchisees and franchise applicants — people who own or applied to run Comfort, Quality, Econo Lodge and other Choice hotels. Names and Social Security numbers were taken. Three lawsuits were filed in Maryland federal court in February 2026; one was dropped. There is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened and What the Lawsuits Say
According to the notice letter Choice Hotels filed with the California Attorney General, “a skilled person used social engineering” to get into the application on January 14, 2026, even though it required multifactor authentication. Choice says it detected the access and shut it down in less than an hour, and on January 26, 2026 determined whose records were involved. It notified law enforcement.
The letter lists the data as name and Social Security number. One complaint describes names, contact information, Social Security numbers and dates of birth. Choice reported the breach to California on February 19, 2026.
The lawsuits allege that Choice failed to use reasonable security for unencrypted personal information and failed to disclose that its practices were inadequate. Those are allegations; Choice has not been found liable for anything. Choice has not published a total count of affected people in any filing we could open.
Case details
All three known suits were filed in the U.S. District Court for the District of Maryland, where Choice is based (North Bethesda):
Faulcon v. Choice Hotels International, Inc., No. 1:26-cv-00744, filed February 23, 2026.
Sanchez v. Choice Hotels International Inc., No. 8:26-cv-00781, filed February 25, 2026. It seeks a jury trial, declaratory and injunctive relief, and actual, statutory and punitive damages for a proposed class.
Mahon v. Choice Hotels International, Inc., No. 8:26-cv-00828, filed February 27, 2026 before Judge Paula Xinis. The plaintiff dismissed it voluntarily, without prejudice; the court closed the case on March 12, 2026.
In its quarterly report for the period ended June 30, 2026, Choice told the SEC it is not a party to litigation other than in the ordinary course of business and does not expect a material adverse effect.
Status: Early Litigation, No Settlement
The one concrete benefit available now comes from Choice itself, not the lawsuits: two years of Epiq Privacy Solutions ID credit monitoring, offered in the notice letter.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
Choice addressed its notice letters to franchisees and franchise applicants. If you only stayed at a Choice hotel as a guest, nothing we found says this 2026 breach involved you.
The practical test is your mail. The letter is headed “Notice of Data Breach,” comes from a Secure Processing Center in Central Islip, NY, and carries an activation code for Epiq credit monitoring. Keep it: it is your proof of membership if a class is ever certified or a settlement reached.
Guests may be thinking of an older, separate incident: Choice told customers that a Safari browser crash issue exposed reservation details, including payment card numbers, approximately 88,000 times from June 2015 through November 12, 2019. That matter is unrelated to the 2026 lawsuits. The similarly named Choice Home Warranty case is a different company entirely.
Is There Money?
What you can use today: the two years of credit monitoring in your letter, which includes $1 million in identity theft insurance per the notice.
Choice Hotels Breach Timeline
January 14, 2026 — Social Engineering Gets In
Per Choice’s notice, a person uses social engineering to access an application holding franchisee and applicant records, despite MFA. Choice says access was shut down in under an hour.
January 26, 2026 — Affected Records Identified
Choice’s review determines which people’s records were involved. Law enforcement is notified.
February 19, 2026 — Breach Reported
The California Attorney General’s breach list shows Choice’s report on this date. Notice letters offer two years of credit monitoring.
February 23–27, 2026 — Three Federal Suits
Faulcon (1:26-cv-00744), Sanchez (8:26-cv-00781) and Mahon (8:26-cv-00828) are filed in the District of Maryland.
March 12, 2026 — Mahon Dismissed
Judge Paula Xinis approves the plaintiff’s voluntary dismissal without prejudice and closes the Mahon case.
October 2026 — No Settlement
As of October 2026 no settlement, fund or claim form has been announced. The current status of Faulcon and Sanchez is unconfirmed.
Three Things to Watch For
A breach of Social Security numbers with no claim form invites imposters:
“Choice Hotels guest settlement” sign-ups
This breach involved franchisee and applicant records, and there is no settlement. A page asking hotel guests for a Social Security number to “join” is collecting data, not filing a claim.
Fake credit-monitoring activation emails
The real enrollment runs through privacysolutionsid.com with the code printed in your letter, and confirmation comes from noreply@privacysolutions.com. An email asking you to “re-verify” your SSN through another link is not part of it.
Calls posing as Choice franchise support
The intruder got in by social engineering, so expect follow-up phishing aimed at franchisees. Call back on the number in your letter, 877-421-8706, rather than any number a caller gives you.
Choice Hotels Breach — Questions People Ask
Short answers to the questions people ask most about this case.
Was Choice Hotels negligent in the data breach?
That is what the lawsuits allege, not what a court has found. The complaints say Choice failed to use reasonable security for unencrypted personal information. Choice says the access required MFA and was shut down in less than an hour. As of October 2026 there is no ruling on the merits we could find.
Which hotels fall under Choice Hotels?
Choice franchises brands including Comfort Inn, Quality Inn, Sleep Inn, Clarion, Econo Lodge, Rodeway Inn, Cambria, Ascend Hotel Collection, MainStay Suites, WoodSpring Suites, Suburban Studios, Country Inn & Suites and the Radisson family — nearly 7,600 hotels at the end of 2024. The 2026 breach involved records about franchisees and applicants, not guest stays.
Was my hotel stay or credit card exposed?
Not by this breach, based on Choice’s notice, which covers name and Social Security number of franchisees and franchise applicants. A separate, older guest issue involving payment cards ran from June 2015 through November 12, 2019 and was reported in 2019.
Can a company get sued for a data breach?
Yes. People whose data was exposed can sue, usually as a class, on theories such as negligence and breach of contract. The Sanchez complaint, for example, alleges Choice failed to use reasonable security for unencrypted information. Filing a suit is not winning one; many end in dismissal, and others settle years later.
Is there a Choice Hotels data breach settlement or claim form?
No. As of October 2026 there is no settlement, no fund, no administrator, no claim form and no deadline. If that changes, class members are notified directly under court supervision.
How many people were affected?
Choice has not published a nationwide total in any filing we could open. The notice is limited to franchisees and franchise applicants whose records were in the accessed application.
Is the letter I got from Choice Hotels real?
The genuine letter is headed “Notice of Data Breach,” comes from a Secure Processing Center, P.O. Box 680, Central Islip, NY, and gives a call center number, 877-421-8706. It offers Epiq Privacy Solutions ID enrollment with an activation code. It does not ask you to pay anything.
What should I do right now?
Activate the two years of credit monitoring in your letter before its enrollment deadline, and freeze your credit at all three bureaus — free and reversible. An initial fraud alert lasts one year. Keep the letter in case a class is ever certified.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.