Social EngineeringHospitalityHospitalityPhishingTargetedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

CHOICE HOTELS INTERNATIONAL INC /DE

bd_0ffa385100f769b7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 26, 2026

Filed

Feb 19, 2026

To disclose

24 days

Affected

66state residents only

Linked

10 filings

Confidence

66%

Full breach record for CHOICE HOTELS INTERNATIONAL INC /DE →3 incidents on file

Choice Hotels International, Inc. reported a data breach affecting 66 Maine residents. On January 14, 2026, an external actor used social engineering to gain unauthorized access to an application containing franchisee records, bypassing MFA. The breach was contained within an hour. Affected data included names, contact info, SSNs, and DOBs. Notifications were sent on February 19, 2026, with two years of credit monitoring offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 26, 2026 → Filed with AG Feb 19, 202624d ✓ ME AG ≤30d24 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 12 days

discovery → filing · 24 days

Jan 14, 2026

Begins

Jan 26, 2026

Discovered

Feb 19, 2026

Filed

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_111e43f23c3cd5962026-02-19Verified
New Hampshire State AGbd_13201bac440a62c22026-02-19Verified
Nebraska State AGbd_2331b2004ebee8422026-02-19Verified
California State AGbd_48ea2a84af5f70552026-02-19Candidate

Show 5 more filings ↓up to 18d gap

Massachusetts State AGbd_84788fc5402c84af2026-02-19Verified
Oregon State AGbd_bdaaf3841a01cd302026-02-19Verified
Vermont State AGbd_df32201abaf622cc2026-02-19Verified
Texas State AGbd_934d91d01e099b7d2026-02-20 · +1dVerified
Illinois State AGbd_d8035ca056fb403f2026-02-01 · +18dVerified

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com
Industry: Hospitalityllm

Discovered: Jan 26, 2026
Breach occurred: Jan 14, 2026
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2026
Affected individuals: 66state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement and is supporting their investigation
Initial access: phishing_link

During the incident: Notified law enforcement and is supporting their investigation
Took measures to shut down access within less than an hour
Conducted an investigation to identify the records that were accessed
Began mailing notification letters via United States Postal Service First-Class mail
Offering all notified individuals two years of complimentary credit monitoring and identity protection services
Established a dedicated, toll-free call center to answer questions
Changes made: Made changes to the application involved to further restrict access to records
Continues to focus on security awareness training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: ME AG ≤30d · 24d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 26, 2026
→ Filed with AG: Feb 19, 2026
24d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 26, 2026 → Filed with AG: Feb 19, 2026	24d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGFeb 1 · first

Indiana State AG+18d

New Hampshire State AG+18d

Nebraska State AG+18d

California State AG+18d

Massachusetts State AG+18d

Oregon State AG+18d

Vermont State AG+18d

Maine State AG+18d · this page

Texas State AG+19d

Pattern: first filing Feb 1 (IL), last Feb 20 (TX) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/05cae016-fc3c-489f-b40d-3fa084a2b7c2.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2026
Raw hash: 26a9f46d7496ba283f0eb29297f0a0a84ad5cecae421746990dd92a07df1d957

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCHOICE HOTELS INTERNATIONAL INC /DE

Victim entityCHOICE HOTELS INTERNATIONAL INC /DE

Incidentdiscovered Jan 26, 2026

Stated responseNotified law enforcement and is supporting their investigation

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov