AccidentalRetail & ConsumerRetailMisdeliveryCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Marriott Ownership Resorts, Inc.

bd_28c35dabd7b02bf0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 27, 2010

Filed

Jan 31, 2011

To disclose

5 weeks

Affected

4state residents only

Confidence

67%

Full breach record for Marriott Ownership Resorts, Inc. →

Marriott Ownership Resorts, Inc. d/b/a Marriott Vacation Club International notified the NH AG on Jan 31, 2011, of lost payment slips containing names, addresses, and full credit card numbers. The loss occurred during shipment from a payment processor to MVCI in Dec 2010. 4 NH residents affected. No evidence of misuse.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 35 days

Dec 27, 2010

Discovered

Jan 31, 2011

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4 affectedView incident

Name: Marriott Vacation Club
norm: marriott vacation club

Name: Marriott Ownership Resorts, Inc.
norm: marriott ownership resorts
Also named: Marriott Ownership Resorts, Inc.dba oflegal entity
Marriott Vacation Club Internationaldba oftrade name
Industry: Retail & Consumerllm

Discovered: Dec 27, 2010
Materiality determined: —
Notification sent: Feb 2, 2011
Affected individuals: 4state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Attorney General

During the incident: Notified all affected individuals
Notified the credit card companies of the individuals involved
Set up a call center to answer the questions of affected individuals
Started a review of its policies and procedures concerning the shipment of processed payment slips
Worked with the shipping company and payment processing bank to ensure that this type of loss cannot occur again
Changes made: Continue to take necessary and appropriate steps to further ensure that all vendors secure personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/marriott-vacation-club-20110131.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2011
Raw hash: 4c7812d9840727d98f2314cf4c953908ed9625b4e1681cd4c64cbc2e392da16f

Reporting entityMarriott Vacation Club

Victim entityMarriott Ownership Resorts, Inc.

Incidentdiscovered Dec 27, 2010

Stated responseNotified all affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov