Social EngineeringHospitalityHospitalityPhishingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

CHOICE HOTELS INTERNATIONAL INC /DE

bd_13201bac440a62c2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 19, 2026

To disclose

—

Affected

67state residents only

Linked

10 filings

Confidence

66%

Full breach record for CHOICE HOTELS INTERNATIONAL INC /DE →3 incidents on file

Choice Hotels International, Inc. notified the NH Attorney General of a data security incident where a skilled person used social engineering to gain unauthorized access to an application containing franchisee and applicant records on January 14, 2026. Access was shut down within an hour. The incident affected 67 New Hampshire residents, exposing names, contact information, Social Security numbers, and dates of birth. Choice Hotels is offering two years of credit monitoring and has implemented additional access restrictions and security training.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 14, 2026

Begins

Feb 19, 2026

Filed

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Maine State AGbd_0ffa385100f769b72026-02-19Verified
Indiana State AGbd_111e43f23c3cd5962026-02-19Verified
Nebraska State AGbd_2331b2004ebee8422026-02-19Verified
California State AGbd_48ea2a84af5f70552026-02-19Candidate

Show 5 more filings ↓up to 18d gap

Massachusetts State AGbd_84788fc5402c84af2026-02-19Verified
Oregon State AGbd_bdaaf3841a01cd302026-02-19Verified
Vermont State AGbd_df32201abaf622cc2026-02-19Verified
Texas State AGbd_934d91d01e099b7d2026-02-20 · +1dVerified
Illinois State AGbd_d8035ca056fb403f2026-02-01 · +18dVerified

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com
Industry: Hospitalityllm

Discovered: —
Breach occurred: Jan 14, 2026
Materiality determined: —
Notification sent: Feb 19, 2026
Affected individuals: 67state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1566 Phishing
Threat actor: External
Regulator citations: Notified law enforcement and is supporting their investigation
Initial access: phishing_link

During the incident: Detected the unauthorized access and took measures to shut down access within less than an hour
Immediately conducted an investigation to identify the records that were accessed
Thoroughly reviewed those records
Notified law enforcement and is supporting their investigation
Began mailing notification letters via United States Postal Service First-Class mail to the involved New Hampshire residents
Offering all notified individuals two years of complimentary credit monitoring and identity protection services
Established a dedicated, toll-free call center to answer questions that individuals may have
Changes made: Made changes to the application involved to further restrict access to records
Continues to focus on security awareness training
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGFeb 1 · first

Maine State AG+18d

Indiana State AG+18d

Nebraska State AG+18d

California State AG+18d

Massachusetts State AG+18d

Oregon State AG+18d

Vermont State AG+18d

New Hampshire State AG+18d · this page

Texas State AG+19d

Pattern: first filing Feb 1 (IL), last Feb 20 (TX) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/choice-hotels-international-20260219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2026
Raw hash: 609a406cc7a8f2d17b1c1860bd902be72c6c41c3ed61e104821b9fe037a7c352

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCHOICE HOTELS INTERNATIONAL INC /DE

Victim entityCHOICE HOTELS INTERNATIONAL INC /DE

IncidentUnknown

Stated responseDetected the unauthorized access and took measures to shut down access within less than an hour

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov