HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)MediumContained

Preferred Hotel Group

bd_3d017bd807f97e42 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2017

Filed

Jun 30, 2017

To disclose

24 days

Affected

1,002state residents only

Linked

6 filings

Confidence

64%

Full breach record for Preferred Hotel Group →2 incidents on file

Preferred Hotel Group notified NH AG of unauthorized access to Sabre Hospitality Solutions' SynXis Central Reservations system. Access occurred Aug 2016–Mar 2017. Unencrypted payment card info and guest PII accessed for ~1,002 NH residents. Sabre notified PHG on June 6, 2017. Notices sent by July 6, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 300 days

discovery → filing · 24 days

Aug 10, 2016

Begins

Jun 6, 2017

Discovered

Jun 30, 2017

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_7bd155a5cc2ba53a2017-06-30Candidate
Montana State AGbd_7ce5af2e70d11e692017-07-06 · +6dVerified by operator
Massachusetts State AGbd_c4c1d41b1917abc72017-07-06 · +6dVerified
Oregon State AGbd_7b0ec09ba7023e8d2017-07-07 · +7dVerified by operator

Show 1 more filing ↓up to 14d gap

California State AGbd_82c19e2c59c9cc9d2017-07-14 · +14dVerified

Name: Preferred Hotel Group
norm: preferred hotel

Name: Preferred Hotel Group
norm: preferred hotel
Industry: Retail & Consumerllm

Discovered: Jun 6, 2017
Breach occurred: Aug 10, 2016 – Mar 9, 2017
Undetected for: 300 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 6, 2017
Affected individuals: 1,002state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via Sabre Hospitality Solutions
Initial access: external_remote_services

During the incident: Working with Sabre to ensure they evaluate and improve their data security processes
Notifying affected guests and member hotels
Notified law enforcement
Notified payment card brands
Notified major credit reporting agencies
Changes made: Sabre to evaluate and improve data security processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGJun 30 · first

New Hampshire State AGJun 30 · first · this page

Montana State AG+6d

Massachusetts State AG+6d

Oregon State AG+7d

California State AG+14d

Pattern: first filing Jun 30 (WA), last Jul 14 (CA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sabre-hospitality-preferred-2170630.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2017
Raw hash: 433f0bbbc26be8fdf506742ec6def9108bd177a4e1953f56127dbb4090373c18

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityPreferred Hotel Group

Victim entityPreferred Hotel Group

Incidentdiscovered Jun 6, 2017

Stated responseWorking with Sabre to ensure they evaluate and improve their data security processes

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov