COMMITMENTS AND CONTINGENCIES

9 Months Ended

Sep. 30, 2025

Commitments and Contingencies Disclosure [Abstract]

Guarantees

We present the maximum potential amount of our future guarantee fundings and the carrying amount of our liability for our debt service, operating profit, and other guarantees for which we are the primary obligor at September 30, 2025 in the following table:


(in millions) Guarantee Type	Maximum Potential Amount of Future Fundings		Recorded Liability for Guarantees
Debt service	$	62	$	6
Operating profit	120		73
Other	21		4
	$	203	$	83

Our maximum potential guarantees listed in the preceding table include $62 million of operating profit guarantees that will not be in effect until the underlying properties open and we begin to operate the properties or certain other events occur.

Starwood Data Security Incident

Description of Event

On November 30, 2018, we announced a data security incident involving unauthorized access to the Starwood Hotels & Resorts Worldwide, LLC, formerly known as Starwood Hotels & Resorts Worldwide, Inc. (“Starwood”), reservations database (the “Data Security Incident”). Working with leading security experts, we determined that there was unauthorized access to the Starwood network since 2014 and that an unauthorized party had copied information from the Starwood reservations database and taken steps towards removing it. We discontinued use of the Starwood reservations database for business operations at the end of 2018.

Litigation, Claims, and Government Investigations

Following our announcement of the Data Security Incident, approximately 100 lawsuits were filed by consumers and others against us in U.S. federal, U.S. state and Canadian courts related to the incident. The plaintiffs in the cases that remain pending, who generally purport to represent various classes of consumers, generally claim to have been harmed by alleged actions and/or omissions by the Company in connection with the Data Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. The active U.S. cases are consolidated in the U.S. District Court for the District of Maryland (the “District Court”), pursuant to orders of the U.S. Judicial Panel on Multidistrict Litigation (the “MDL”). On June 3, 2025, the U.S. Court of Appeals for the Fourth Circuit reversed the District Court’s certification of a class of consumer plaintiffs, holding that a class-action waiver signed by putative class members was enforceable. We expect to engage in mediation with the consumer plaintiffs in the 2025 fourth quarter. The Canadian cases have effectively been consolidated into a single case in the province of Ontario. We dispute the allegations in these lawsuits and are vigorously defending against such claims.

In the 2025 third quarter, we reached a settlement in the case brought by the City of Chicago (which was consolidated in the MDL proceeding). The settlement amount is not material to our Financial Statements.

In addition, most inquiries and investigations by U.S. federal, U.S. state and foreign governmental authorities have been resolved or no longer appear to be active.

While we believe it is reasonably possible that we may incur losses in excess of the amounts recorded associated with the above-described MDL proceedings or further regulatory investigations related to the Data Security Incident, it is not possible to reasonably estimate the amount of such losses or range of loss in excess of the amounts recorded that might result from adverse judgments, settlements, fines, penalties or other resolution of these proceedings and investigations based on: (1) in the case of the above-described MDL proceedings, the current stage of these proceedings, the absence of specificity as to alleged damages, the uncertainty as to the certification of a class or classes and the size of any certified class, and the lack of resolution of significant factual and legal issues, and (2) uncertainty regarding further regulatory inquiries or investigations.

Insurance Recoveries

During the 2025 third quarter, we recorded insurance recoveries for costs incurred related to the Data Security Incident, which are not material to our Financial Statements. We recognize insurance recoveries when they are probable of receipt and present them in our Income Statements in the same caption as the related expense, up to the amount of total expense incurred in prior and current periods. Insurance recoveries related to the Data Security Incident recorded in the 2025 third quarter are presented in the “Restructuring and merger-related (recoveries) charges, and other” caption of our Income Statements.

Other Legal Proceedings

We have been and are currently party to other legal proceedings involving claims that we infringe the intellectual property rights of others. At this time, we do not expect these proceedings to have a material impact on the Company’s business, financial condition, results of operations, or cash flows.