HackingOtherStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPCIFinancial accountIdentity (basic)LowContained

Preferred Hotels & Resorts

bd_24e0474a5c4393b2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 2, 2018

Filed

Mar 2, 2018

To disclose

≤1 day

Affected

20state residents only

Linked

5 filings

Confidence

66%

Preferred Hotels & Resorts notified the NH AG of a third-party breach involving Sabre/SynXis. Unauthorized access to user credentials allowed viewing of reservation data (payment cards, PII) between June 2016 and Nov 2017. Approx 20 NH residents affected. Notifications sent March 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 639 days

discovery → filing · ≤1 day / 0 days

Jun 1, 2016

Begins

Mar 2, 2018

Discovered

Mar 2, 2018

Filed

vs. sector median

8 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_0b11bd44018a4b032018-03-02Candidate
Oregon State AGbd_92af1cd4dff3ae962018-03-02Verified
California State AGbd_b9283f1173df061d2018-03-02Verified
Massachusetts State AGbd_34823ecac168feff2018-03-09 · +7dVerified

Name: Cooley LLP
norm: cooley

Name: Preferred Hotels & Resorts
norm: preferred hotels
Industry: Otherllm

Discovered: Mar 2, 2018
Breach occurred: Jun 1, 2016 – Nov 30, 2017
Undetected for: 639 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 5, 2018
Affected individuals: 20state-resident count only
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcementNotified payment card brands
Third party: via Sabre/SynXis
Initial access: valid_credentials

During the incident: Initiated an investigation into the incident
Communicated extensively with the vendor
Notifying affected individuals
Changes made: Vendor enhanced security around access credentials
Vendor enhanced monitoring of system activity
Improving security and protection of all reservations information
Enhancing all systems to help prevent this type of incident from recurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Washington State AGMar 2 · first

Oregon State AGMar 2 · first

California State AGMar 2 · first

New Hampshire State AGMar 2 · first · this page

Massachusetts State AG+7d

Pattern: first filing Mar 2 (WA), last Mar 9 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/preferred-hotels-20180302.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2018
Raw hash: 3bfed32247c859623f3ccbf1cdb3daa0ea7101ac2da32c1850481787012d2eb3

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCooley LLP

Victim entityPreferred Hotels & Resorts

Incidentdiscovered Mar 2, 2018

Stated responseInitiated an investigation into the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov