DisclosureLens
MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedTargetedFinancial accountPIILowContained

HEI Hotels & Resorts

bd_4c86346afddc039d · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 12, 2016

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

66%
Full breach record for HEI Hotels & Resorts →

HEI Hotels & Resorts notified the New Hampshire Attorney General of a security incident involving point-of-sale malware installed on payment processing systems at multiple Marriott, Hyatt, and Westin properties. The malware captured payment card data (account number, expiration, verification code) for transactions between December 2, 2015, and June 21, 2016. HEI engaged forensic experts, disabled the malware, and separated payment processing from its network. The exact number of affected individuals is unknown.

Incident timeline

Dec 2, 2015

Begins

Aug 12, 2016

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Filing propagation · 3 filings · 3 states

View merged incident ↗
Montana State AGAug 12 · first
California State AGAug 12 · first
New Hampshire State AGAug 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.