HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICLowContained
Ashford Inc.
bd_05df681a34121037 · schema v1 · pii pii-v1
Full breach record for Ashford Inc. →Ashford, Inc. notified the California AG of an incident where an unauthorized actor accessed systems on September 7, 2023, and acquired files containing names and other personal information. Ashford became aware of suspicious activity on September 20, 2023. The company engaged forensic specialists, secured systems, and offered 24 months of credit monitoring. No evidence of fraudulent misuse was found.
California clockDiscovered Sep 20, 2023 → Notified Jan 19, 2024121d ✗ CA 60-day late17 weeks discovery → filing
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_3654e540ca3be24eVermont State AGfiled 2024-01-19Verified
- bd_5ee7e5c065ec7b49Maine State AGfiled 2024-01-19Candidate
- bd_896471028c60fa93New Hampshire State AGfiled 2024-01-19Verified
- bd_ce299ece664da47eMontana State AGfiled 2024-01-19Verified
Show 1 more filing ↓Show fewer ↑
- bd_eda317d8129af43aIndiana State AGfiled 2024-01-19Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-579636
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 19, 2024
- Raw hash
- 5186d215e0113d6139c80fa367380e1d0b87a7170daa30dfc4abef59b1774082
Reporting entity
- Name
- Ashford Inc.norm: ashford
- Domain
- ashfordinc.com
Victim entity
- Name
- Ashford Inc.norm: ashford
- Domain
- ashfordinc.com
Incident
- Discovered
- Sep 20, 2023
- Materiality determined
- —
- Notification sent
- Jan 19, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified federal law enforcement and other regulators as required
Compliance
- Time to disclose
- 17 weeks(121 days from discovery to filing)
- Compliance flags
- CA 60-day late · 121d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 20, 2023→ Notified: Jan 19, 2024121d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.