Social EngineeringRetail & ConsumerRetailPhishingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

CHOICE HOTELS INTERNATIONAL INC /DE

bd_2331b2004ebee842 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jan 14, 2026

Filed

Feb 19, 2026

To disclose

—

Affected

198state residents only

Linked

10 filings

Confidence

66%

Full breach record for CHOICE HOTELS INTERNATIONAL INC /DE →3 incidents on file

Choice Hotels International, Inc. reported a data breach affecting 198 Nebraska residents. On January 14, 2026, an external actor used social engineering (phishing) to gain unauthorized access to an application containing franchisee records, bypassing MFA. The breach exposed names, contact info, SSNs, and DOBs. Choice Hotels detected the access within an hour, shut it down, notified law enforcement, and began mailing notifications on February 19, 2026, offering two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 14, 2026

Begins

Jan 14, 2026

Discovered

Feb 19, 2026

Filed

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Maine State AGbd_0ffa385100f769b72026-02-19Verified
Indiana State AGbd_111e43f23c3cd5962026-02-19Verified
New Hampshire State AGbd_13201bac440a62c22026-02-19Verified
California State AGbd_48ea2a84af5f70552026-02-19Candidate

Show 5 more filings ↓up to 18d gap

Massachusetts State AGbd_84788fc5402c84af2026-02-19Verified
Oregon State AGbd_bdaaf3841a01cd302026-02-19Verified
Vermont State AGbd_df32201abaf622cc2026-02-19Verified
Texas State AGbd_934d91d01e099b7d2026-02-20 · +1dVerified
Illinois State AGbd_d8035ca056fb403f2026-02-01 · +18dVerified

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com
Industry: Retail & Consumerllm

Discovered: Jan 14, 2026
Breach occurred: Jan 14, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2026
Affected individuals: 198state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement and is supporting their investigation
Initial access: phishing_link

During the incident: Notified law enforcement and is supporting their investigation
Began mailing notification letters via United States Postal Service First-Class mail to the involved Nebraska residents
Offered all notified individuals two years of complimentary credit monitoring and identity protection services
Established a dedicated, toll-free call center to answer questions
Changes made: Made changes to the application involved to further restrict access to records
Continues to focus on security awareness training
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGFeb 1 · first

Maine State AG+18d

Indiana State AG+18d

New Hampshire State AG+18d

California State AG+18d

Massachusetts State AG+18d

Oregon State AG+18d

Vermont State AG+18d

Nebraska State AG+18d · this page

Texas State AG+19d

Pattern: first filing Feb 1 (IL), last Feb 20 (TX) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/7f511d2c-3a5c-459b-9cdd-1edb2c9dc1b8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2026
Raw hash: f61700839e1208d839789cc03fa53e07a8a25799dbda546152b54840d9438a96

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCHOICE HOTELS INTERNATIONAL INC /DE

Victim entityCHOICE HOTELS INTERNATIONAL INC /DE

Incidentdiscovered Jan 14, 2026

Stated responseNotified law enforcement and is supporting their investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov