MalwareRansomwareData ExfiltratedCustomer Data InvolvedPCIFINANCIAL_ACCOUNTLowContained
Six Continents Hotels
bd_3d49f29564c392be · schema v1 · pii pii-v1
Full breach record for Six Continents Hotels →InterContinental Hotels Group (IHG) notified guests of a payment card incident affecting 12 managed properties in the Americas. Malware installed on servers processing payments at restaurants and bars (Aug-Dec 2016) captured track data from magnetic stripes. IHG engaged forensic firms, notified law enforcement, and worked with card networks for heightened monitoring. No specific count of affected individuals was disclosed in this filing.
California clockDiscovered Dec 28, 2016 → Notified Feb 3, 201737d ✓ CA 60-day OK5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-66180
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 3, 2017
- Raw hash
- 42ad1b56f2af4df329e83f49f89d85b17bcca92ca0355398f14cdceb35b9e97c
Reporting entity
- Name
- Six Continents Hotelsnorm: six continents hotels
- Domain
- ihg.com
- Industry
- Hospitality
Victim entity
- Name
- Six Continents Hotelsnorm: six continents hotels
- Domain
- ihg.com
- Industry
- Hospitality
Incident
- Discovered
- Dec 28, 2016
- Materiality determined
- —
- Notification sent
- Feb 3, 2017
- Affected individuals
- Not disclosed
- Data types
- PCIFINANCIAL_ACCOUNT
- Attack vector
- Unknown
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed breach notification with California Office of the Attorney General
Compliance
- Time to disclose
- 5 weeks(37 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 37d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 28, 2016→ Notified: Feb 3, 201737d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.