The plaintiff would need to be IHG. I doubt they'd want any such case to come to court considering the bad publicity that might result from their appalling Infosec policies being openly discussed.

It is absolutely disgraceful that this situation has persisted for so long. Accounts hacked left, right and centre because a 4-digit pin for logins is grossly insecure but still IHG does nothing.