HackingIdentity (basic)Financial accountFinancial credentialsLowContained

Resort Data Processing

bd_4cccc0c6aa4605c7 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 23, 2026

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for Resort Data Processing →4 incidents on file

Resort Data Processing (RDP) disclosed a security event where an unauthorized actor used compromised vendor credentials to scrape customer reservation data, including names, payment card numbers, CVVs, and expiration dates. The incident occurred between December 25, 2024, and January 22, 2025. RDP engaged forensic investigators, offered one year of credit monitoring via Kroll, and implemented additional system safeguards.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 25, 2024

Begins

Apr 23, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com

Discovered: —
Breach occurred: Dec 25, 2024 – Jan 22, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Engaged a forensic firm to investigate
Offered one year of complimentary credit monitoring and identity restoration services through Kroll
Changes made: Deployed additional safeguards onto systems
Reinforced security practices
Actively reviewing systems to enhance security monitoring and controls
Fortified security systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376723.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2026
Raw hash: bec18649ba93b3e8b501ebfb1943ffe9dea040368177e25ec6d5d5b75cc41ccf

Reporting entityResort Data Processing

Victim entityResort Data Processing

IncidentUnauthorized Access

Stated responseEngaged a forensic firm to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov