HackingHospitalityHospitalityStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)LowContained

Grand Sierra Resort

bd_2dfd5c9b2d3b25cf · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 6, 2015

Filed

Jun 20, 2016

To disclose

46 weeks

Affected

42state residents only

Linked

4 filings

Confidence

66%

Full breach record for Grand Sierra Resort →

Grand Sierra Resort notified New Hampshire residents of a data breach where unauthorized access to payment card data occurred between June 20 and August 6, 2015. The incident affected 42 NH residents, exposing names, credit card numbers, and track data. The resort enhanced security measures and established a hotline for affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 47 days

discovery → filing · 46 weeks / 319 days

Jun 20, 2015

Begins

Aug 6, 2015

Discovered

Jun 20, 2016

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_a2fead94c37f7a7c2016-06-13 · +7dVerified
Washington State AGbd_50d6ffaa95fd74fb2016-06-10 · +10dVerified
Montana State AGbd_7cd434b55e71997e2016-06-06 · +14dCandidate

Name: Grand Sierra Resort
norm: grand sierra resort

Name: Grand Sierra Resort
norm: grand sierra resort
Industry: Hospitalityllm

Discovered: Aug 6, 2015
Breach occurred: Jun 20, 2015 – Aug 6, 2015
Undetected for: 47 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 6, 2016
Affected individuals: 42state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Providing written notice of this incident to other state regulators
Initial access: valid_credentials

During the incident: Began to investigate and to prevent further unauthorized access to customer payment information
Enhanced existing security measures to prevent further unauthorized access to customer payment information
Provided potentially impacted customers with guidance on how to protect against identity theft and fraud
Established a dedicated hotline for potentially affected individuals to contact with questions or concerns regarding this incident
Providing written notice of this incident to other state regulators and the national consumer reporting agencies as necessary
Changes made: Enhanced existing security measures to prevent further unauthorized access to customer payment information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 46 weeks(319 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJun 6 · first

Washington State AG+4d

Massachusetts State AG+7d

New Hampshire State AG+14d · this page

Pattern: first filing Jun 6 (MT), last Jun 20 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mei-gsr-20160610.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2016
Raw hash: 8f96c7b8bec0d7d76f6d8cd5084db7a64da0aa811cb459f5b41907fb620b9d44

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityGrand Sierra Resort

Victim entityGrand Sierra Resort

Incidentdiscovered Aug 6, 2015

Stated responseBegan to investigate and to prevent further unauthorized access to customer payment information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov