The Attorney general of the U.S. state of New York on Friday announced an investigation into the massive data breach of the hotel chain Marriott, which might have affected over 500 million people.

NY Attorney General Barbara Underwood said in a tweet that "New Yorkers deserve to know that their personal information will be protected."

It remains unclear what legal implications the move might have on the hotel group. Experts say it could face penalties for failing to fulfill its obligations of consumer data protection.

Marriott said earlier on Friday that information of over 500 million customers of the former Starwood hotels, which Marriott acquired two years ago, may have been compromised.

The leaked data generally include customers' names, mailing addresses, phone numbers, and passport numbers. Some even contain credit card names and expiration dates.

The company found that unauthorized access into the data at Starwood had been happening since 2014.

Marriott's stock plunged over 5 percent on the data breach report.

Hotel brands operated under Starwood include W Hotels, St. Regis, Sheraton, Westin, among others.