HackingRetail & ConsumerHospitalityRetailStolen CredentialsTargetedData ExfiltratedPCIFinancial accountIdentity (basic)LowContained

Hershey Entertainment & Resorts Company

bd_5539631c901e08f2 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 30, 2015

Filed

Jul 10, 2015

To disclose

6 weeks

Affected

187state residents only

Confidence

66%

Full breach record for Hershey Entertainment & Resorts Company →

Hershey Entertainment & Resorts Company notified the NH Attorney General of a payment card skimming incident. An unauthorized program copied magnetic stripe data (card numbers, names, etc.) from Feb 14 to June 2, 2015. Discovered May 30, 2015. 187 NH residents notified. Remediation included engaging a security firm and offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 105 days

discovery → filing · 6 weeks / 41 days

Feb 14, 2015

Begins

May 30, 2015

Discovered

Jul 10, 2015

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed187 affectedView incident

Name: Hershey Entertainment & Resorts Company
norm: hershey entertainment resorts

Name: Hershey Entertainment & Resorts Company
norm: hershey entertainment resorts
Industry: Retail & ConsumerllmHospitalityllm

Discovered: May 30, 2015
Breach occurred: Feb 14, 2015 – Jun 2, 2015
Undetected for: 105 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2015
Affected individuals: 187state-resident count only
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Engaged a leading computer security firm to examine its payment card system
Working with the security firm to remediate the incident
Offering a free, one-year membership of Experian’s ProtectMyID Alert
Providing call center support for affected individuals
Changes made: Reviewing security measures
Ensuring the issue has been fully remediated
Looking for ways to enhance security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hershey-entertainment-20150710.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2015
Raw hash: 97517a2d629fc419993b13a71ff6bacb932db1d37c633d67ad7e7a5b54381543

Reporting entityHershey Entertainment & Resorts Company

Victim entityHershey Entertainment & Resorts Company

Incidentdiscovered May 30, 2015

Stated responseEngaged a leading computer security firm to examine its payment card system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov