A national class action lawsuit has been filed against Marriott International on behalf of over 500 million guests who had their information compromised by a security breach.

Murphy, Falcon & Murphy, with their co-counsel Morgan & Morgan, filed the lawsuit Friday alleging that Marriott failed to “ensure the integrity of its servers and to properly safeguard consumers’ highly sensitive and confidential information.”

The breach exposed in some cases credit card numbers, passport numbers and birthdates, addresses and other personal information. Marriott did not discover the breach until Sept. 4, 2018, which was up to four years after Marriott’s servers were hacked.

Marriott CEO Arne Sorenson said in a prepared statement, “We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”

Emails to guests who had stayed at affected brands began rolling out Friday.

Affected hotel brands operated by Starwood before it was acquired by Marriott in 2016 include W Hotels, St. Regis, Sheraton, Westin, Element, Aloft, The Luxury Collection, Le Méridien and Four Points. Starwood branded timeshare properties are also included.

There are 34 Marriott hotels and timeshares in Hawaii, including well-known properties formerly managed by Starwood such as The Royal Hawaiian, Sheraton Waikiki and Moana Surfrider. None of the Marriott branded hotels are threatened.

Hassan Murphy, a managing partner at Murphy, Falcon & Murphy, said in a statement, “Marriott is one of the largest hotel chains in the world. That such a corporation would fail to properly safeguard the highly personal and sensitive information of its guests and customers is inexplicable.”

Murphy, who also is currently involved in the nationwide consumer data breach litigation against Equifax Inc., said Marriott’s failure to promptly discover the breach and disclose it to guests constitutes “a significant breach of trust and confidence unparalleled in the hospitality industry.”

The Marriott breach may be among the largest data breaches on record. Last year’s Equifax hack affected more than 145 million.

“Marriott’s conduct has compromised every aspect of its customers’ personal identities, exposing them to identity theft, fraud, and harm for years to come. We will continue working until Marriott fixes this problem and appropriately compensates its victims for their losses,” he said.

The Associated Press contributed to this report.