MalwareHospitalityHospitalityInfostealerData ExfiltratedPCIFinancial accountLowContained

Rosen Hotels & Resorts

bd_4f7660b0923ac5ed · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 3, 2016

Filed

Mar 4, 2016

To disclose

4 weeks

Affected

9state residents only

Linked

4 filings

Confidence

64%

Full breach record for Rosen Hotels & Resorts →

Rosen Hotels & Resorts disclosed a payment card incident where malware installed in its payment card network captured magnetic stripe data (card numbers, names, expiration dates) from guests who stayed between Sept 2, 2014, and Feb 18, 2016. The company detected unauthorized charges on Feb 3, 2016, hired a cybersecurity firm, and notified affected guests via letter/email on March 4, 2016.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 519 days

discovery → filing · 4 weeks / 30 days

Sep 2, 2014

Begins

Feb 3, 2016

Discovered

Mar 4, 2016

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_b16dffb998cfb4002016-03-04Verified
New Hampshire State AGbd_cc33a49c08666b862016-03-04Verified
Massachusetts State AGbd_5b489425d8f6ac392016-03-08 · +4dVerified

Name: Rosen Hotels & Resorts
norm: rosen hotels resorts
Domain: rosenhotels.com

Name: Rosen Hotels & Resorts
norm: rosen hotels resorts
Domain: rosenhotels.com
Industry: Hospitalityllm

Discovered: Feb 3, 2016
Breach occurred: Sep 2, 2014 – Feb 18, 2016
Undetected for: 519 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2016
Affected individuals: 9state-resident count only
Data types: PCIFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Supporting law enforcement’s investigation

During the incident: Hired a leading cyber security firm to examine our payment card processing system
Working with the payment card networks to identify the potentially affected cards
Supporting law enforcement’s investigation
Established a dedicated helpline
Implemented additional, enhanced security measures
Changes made: Implemented additional, enhanced security measures to help prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGMar 4 · first

New Hampshire State AGMar 4 · first

Montana State AGMar 4 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Rosen-Hotels-Resorts.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2016
Raw hash: 635f05e2a81d84a3a59742f7b9b2863747ebc5bb934b2a70218391c42d8e45e1

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRosen Hotels & Resorts

Victim entityRosen Hotels & Resorts

Incidentdiscovered Feb 3, 2016

Stated responseHired a leading cyber security firm to examine our payment card processing system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov