MalwareHospitalityHospitalityRansomwareData EncryptedTargetedFinancial accountFinancial credentialsPIILowContained

Island Hotel Company - Atlantis Paradise Island

bd_1e8888232b095980 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 21, 2016

Filed

Nov 28, 2016

To disclose

5 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Island Hotel Company - Atlantis Paradise Island →2 incidents on file

Atlantis, Paradise Island notified South Carolina of a data security incident affecting payment card data (card number, expiration, CVV, name) from customers using food/beverage and retail locations between March 9 and October 22, 2016. Malware captured data. The Resort engaged forensic experts, removed malware, and implemented additional procedures. No SSN or PINs were involved. The incident was discovered on October 21, 2016.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 226 days

discovery → filing · 5 weeks / 38 days

Mar 9, 2016

Begins

Oct 21, 2016

Discovered

Nov 28, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Island Hotel Company - Atlantis Paradise Island
norm: island hotel company atlantis paradise island
Domain: atlantisbahamas.com
Industry: hospitality

Name: Island Hotel Company - Atlantis Paradise Island
norm: island hotel company atlantis paradise island
Domain: atlantisbahamas.com
Industry: hospitality
Industry: Hospitalityllm

Discovered: Oct 21, 2016
Breach occurred: Mar 9, 2016 – Oct 22, 2016
Undetected for: 226 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 21, 2016
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsPII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial

During the incident: Began working with third-party forensic experts to investigate
Removed the malware at issue to contain this incident
Implemented additional procedures in an effort to prevent any further unauthorized access
Changes made: Implemented additional procedures in an effort to prevent any further unauthorized access to customers’ credit and debit card information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/IslandHotelCompany.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 28, 2016
Raw hash: 2dd471bfc03fe9ee6817d41a437f0052051bd9cdb40d109be724ae37871c5034

Reporting entityIsland Hotel Company - Atlantis Paradise Island

Victim entityIsland Hotel Company - Atlantis Paradise Island

Incidentdiscovered Oct 21, 2016

Stated responseBegan working with third-party forensic experts to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov