HackingHospitalityHospitalityData ExfiltratedCustomer Data InvolvedPCIFinancial accountIdentity (basic)LowContained

Bartell Hotels

bd_19f3f1d66edd4b89 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 29, 2014

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Bartell Hotels →

Bartell Hotels disclosed that a third-party attacker compromised payment card processing systems at five San Diego locations between February 16, 2014, and May 13, 2014. The incident exposed credit card numbers and names. The company notified law enforcement and credit card brands, remediated the vulnerability, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 16, 2014

Begins

Aug 29, 2014

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_d730f6a5260104732014-09-12 · +14dVerified
Massachusetts State AGbd_a5e497e6ab3a41322014-09-15 · +17dVerified

Name: Bartell Hotels
norm: bartell hotels
Domain: bartellhotels.com

Name: Bartell Hotels
norm: bartell hotels
Domain: bartellhotels.com
Industry: Hospitalityllm

Discovered: —
Breach occurred: Feb 16, 2014 – May 13, 2014
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified law enforcementNotified credit card brands

During the incident: Immediately began an investigation to confirm the nature of the unauthorized access
Notified law enforcement
Notified credit card brands
Addressed and remediated the root of the problem
Changes made: Addressed and remediated the root of the problem
Intend to provide affected individuals with credit monitoring and identity protection services through AllClear ID
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGAug 29 · first · this page

New Hampshire State AG+14d

Massachusetts State AG+17d

Pattern: first filing Aug 29 (CA), last Sep 15 (MA) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-46440
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2014
Raw hash: 9cc8f9ed20ddcdd79e6cf402c3dff824b3ecdce54a9f7889dcd5ee18b478fb56

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBartell Hotels

Victim entityBartell Hotels

IncidentUnauthorized Access

Stated responseImmediately began an investigation to confirm the nature of the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov