HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

Red Roof Inns

bd_3bf4ce52edab959c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 6, 2017

Filed

Aug 29, 2017

To disclose

12 weeks

Affected

25state residents only

Linked

2 filings

Confidence

66%

Full breach record for Red Roof Inns →3 incidents on file

Red Roof Inns reported a data breach involving its third-party vendor Sabre Hospitality Solutions (SHS). Unauthorized access occurred on August 10, 2016, discovered by SHS on June 6, 2017. The incident exposed customer names, addresses, emails, phone numbers, and credit/debit card details (including CVV). 25 New Hampshire residents were notified on August 28, 2017. Law enforcement was contacted.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 300 days

discovery → filing · 12 weeks / 84 days

Aug 10, 2016

Begins

Jun 6, 2017

Discovered

Aug 29, 2017

Filed

vs. sector median

+5 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_3955f2c7f0650ed32017-08-29Candidate

Name: THOMPSON COBURN LLP
norm: thompson coburn
Domain: thompsoncoburn.com

Name: Red Roof Inns
norm: red roof inns
Industry: Retail & Consumerllm

Discovered: Jun 6, 2017
Breach occurred: Aug 10, 2016
Undetected for: 300 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2017
Affected individuals: 25state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Working closely with SHS to ensure that appropriate steps have been taken to prevent this type of incident from occurring in the future
Affected customers were provided with additional information for monitoring their identity and credit cards
Vendor contacted law enforcement and is fully cooperating with their investigation
Changes made: Reviewing its policies and procedures to prevent this sort of incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGAug 29 · first

New Hampshire State AGAug 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sabre-hospitality-red-roof-20170829.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2017
Raw hash: 6d55d76cccfdba6e4521e79d400fe552d179e7319c02bd1dd1fe744f2a3b6f0f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTHOMPSON COBURN LLP

Victim entityRed Roof Inns

Incidentdiscovered Jun 6, 2017

Stated responseWorking closely with SHS to ensure that appropriate steps have been taken to prevent this type of incident from occurring in the future

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov