HackingTechnologyInformationVulnerability ExploitCapture Stored DataData ExfiltratedTargetedPIIFinancial accountIdentity (basic)LowContained

Resort Data Processing

bd_26e0d8d5acfcd4f8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 14, 2021

Filed

Jul 23, 2021

To disclose

6 weeks

Affected

37state residents only

Linked

10 filings

Confidence

63%

Full breach record for Resort Data Processing →4 incidents on file

Resort Data Processing, Inc. notified affected individuals of a cybersecurity attack on its online booking system. Attackers exploited a vulnerability to exfiltrate payment card information and PII from reservations made between Jan 2019 and June 2021. The company engaged forensic investigators, deployed a patch, and enhanced security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 865 days

discovery → filing · 6 weeks / 39 days

Jan 31, 2019

Begins

Jun 14, 2021

Discovered

Jul 23, 2021

Filed

vs. sector median

13 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Massachusetts State AGbd_9f4b7050f82829782021-07-23Verified
Montana State AGbd_ccfadf2ce48081122021-07-23Verified
Oregon State AGbd_7ff3dec2010370682021-07-22 · +1dVerified
New Hampshire State AGbd_8d365a8625c524b12021-07-22 · +1dVerified

Show 5 more filings ↓up to 9d gap

California State AGbd_9dcdd5d44158e3b02021-07-22 · +1dVerified
Montana State AGbd_8b312adb02cdb1752021-07-27 · +4dVerified
Maine State AGbd_32db99b757ca2d672021-07-14 · +9dCandidate
Indiana State AGbd_602f99f557079f092021-07-14 · +9dVerified
Washington State AGbd_78e25fe4ecbfdb012021-07-14 · +9dVerified

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com
Industry: Technologyllm

Discovered: Jun 14, 2021
Breach occurred: Jan 31, 2019 – Jun 14, 2021
Undetected for: 865 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 23, 2021
Affected individuals: 37state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Terminated the attackers’ access
Developed and deployed a security patch
Enlisted a leading cybersecurity forensics firm to assist us in fully investigating the incident
Changes made: Fixed the software vulnerability
Consulting with cybersecurity experts to identify and implement additional controls to further enhance our online booking system’s security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

Maine State AGJul 14 · first

Indiana State AGJul 14 · first

Washington State AGJul 14 · first

Oregon State AG+8d

New Hampshire State AG+8d

California State AG+8d

Massachusetts State AG+9d

Montana State AG+9d

Montana State AG+9d · this page

Montana State AG+13d

Pattern: first filing Jul 14 (ME), last Jul 27 (MT) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-104.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 23, 2021
Raw hash: 8b1f47d9f457ea20be7bd8c031acb068361c801ecca711ac39463b28d2a270b7

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityResort Data Processing

Victim entityResort Data Processing

Incidentdiscovered Jun 14, 2021

Stated responseTerminated the attackers’ access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov