MalwareHospitalityHospitalityInfostealerData ExfiltratedTargetedPIIFinancial accountFinancial credentialsLowContained

626498 Alberta Ltd.

bd_47d2583127376241 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 20, 2017

Filed

Sep 21, 2017

To disclose

9 weeks

Affected

6state residents only

Confidence

64%

626498 Alberta Ltd. (Best Western Plus Wine Country Hotel) notified guests of a malware incident affecting reservation systems from Sept 2016 to July 2017. Infected computers collected names, addresses, credit card numbers, expiration dates, and CVVs. Forensic investigators were hired, malware removed, and law enforcement notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 306 days

discovery → filing · 9 weeks / 63 days

Sep 17, 2016

Begins

Jul 20, 2017

Discovered

Sep 21, 2017

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6 affectedView incident

Name: 626498 Alberta Ltd.
norm: 626498 alberta

Name: 626498 Alberta Ltd.
norm: 626498 alberta
Industry: Hospitalityllm

Discovered: Jul 20, 2017
Breach occurred: Sep 17, 2016 – Jul 20, 2017
Undetected for: 306 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 18, 2017
Affected individuals: 6state-resident count only
Data types: PIIFinancial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: notify any required state regulatorsnotify the credit reporting agencies

During the incident: Launched an internal investigation
Hired a forensic investigator
Removed the malware
Implemented additional security measures
Completely rebuilding the front desk computers
Disabled email and internet access at front desk computers
Enhancing staff training
Notified law enforcement
Changes made: Completely rebuilding the front desk computers
Disabled email and internet access at front desk computers
Enhancing staff training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Best-Western-Plus-Wine-Country-Hotel.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 21, 2017
Raw hash: bf713221cc1fc795f9a5527ebcaefed54bbee33278723979fe0209e10c3dfaf5

Reporting entity626498 Alberta Ltd.

Victim entity626498 Alberta Ltd.

Incidentdiscovered Jul 20, 2017

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov