HackingData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPIIMediumContained
Island Hospitality
bd_392e6d3a08a4e9c3 · schema v1 · pii pii-v1
Full breach record for Island Hospitality →Island Hotel Company Limited (dba Atlantis Paradise Island) notified the NH AG of a data security incident affecting 83 NH residents. Unauthorized access to a US-based corporate server occurred between Oct 17-19, 2020, discovered Oct 18, 2020. Data included SSNs, credit/debit card numbers, financial accounts, passport numbers, and health insurance IDs. Notification mailed March 8, 2021. Remediation included MFA, employee training, and enhanced monitoring. Affected individuals offered 12 months of identity monitoring via Kroll.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed83 affectedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/island-hotel-company-20210311.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 11, 2021
- Raw hash
- d279a9e440d0c82d9026833f7a0a738a93d830f861e4a4c4cd5ba95bbd4ca47a
Reporting entity
- Name
- Morris, Manning & Martin, LLPnorm: morris manning martin
- Domain
- mmmlaw.com
Victim entity
- Name
- Island Hospitalitynorm: island hospitality
- Domain
- island-hospitality.com
Incident
- Discovered
- Oct 18, 2020
- Materiality determined
- —
- Notification sent
- Mar 8, 2021
- Affected individuals
- 83
- Data types
- IDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified the New Hampshire Attorney General Consumer Protection Bureau
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 21 weeks(144 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.