MalwareHospitalityHospitalityInfostealerTargetedPCIFinancial accountLowContained

BENCHMARK, a global hospitality company

bd_0ce190428cb4583c · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 24, 2017

To disclose

—

Affected

Not disclosed

Confidence

66%

Benchmark, a hospitality management company, notified customers of a payment card incident affecting six managed properties from October 2016 to January 2017. Malware installed on payment processing devices captured cardholder track data. Benchmark engaged a cybersecurity firm, contained the malware, and is implementing encryption and EMV readers.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 23, 2016

Begins

Feb 24, 2017

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: BENCHMARK, a global hospitality company
norm: benchmark
Domain: cpubenchmark.net

Name: BENCHMARK, a global hospitality company
norm: benchmark
Domain: cpubenchmark.net
Industry: Hospitalityllm

Discovered: —
Breach occurred: Oct 23, 2016 – Jan 1, 2017
Materiality determined: —
Notification sent: Feb 24, 2017
Affected individuals: Not disclosed
Data types: PCIFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial

During the incident: Hired a leading cybersecurity firm to assist with investigation
Taken measures to contain this incident and eradicate the malware
Working with payment card networks so that banks can initiate heightened monitoring
Changes made: Completing the implementation of point to point encryption
Installation of EMV readers at properties
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Benchmark.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2017
Raw hash: b1aadf5de2c6e9075ae2bce517381b8b562d21131fb74d1ffa650bcf9b312614

Reporting entityBENCHMARK, a global hospitality company

Victim entityBENCHMARK, a global hospitality company

IncidentUnknown

Stated responseHired a leading cybersecurity firm to assist with investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov