AccidentalHospitalityHospitalityMisconfigurationCustomer Data InvolvedGovernment IDFinancial accountIdentity (basic)MediumContained

CHOICE HOTELS INTERNATIONAL INC /DE

bd_70afab2f954b1331 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 1, 2011

Filed

Apr 25, 2012

To disclose

21 weeks

Affected

59state residents only

Linked

3 filings

Confidence

67%

Full breach record for CHOICE HOTELS INTERNATIONAL INC /DE →3 incidents on file

Choice Hotels International notified the NH AG of a database misconfiguration where sensitive guest data (SSN, credit card, driver's license) was inadvertently printed on mail envelopes. Discovered late Dec 2011. ~59 NH residents affected. No evidence of misuse. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 146 days

Dec 1, 2011

Discovered

Apr 25, 2012

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_454803b5ec93a9f72012-04-26 · +1dVerified
Massachusetts State AGbd_e3b191b1a06b42382012-04-30 · +5dVerified

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com
Industry: Hospitalityllm

Discovered: Dec 1, 2011
Materiality determined: —
Notification sent: Apr 25, 2012
Affected individuals: 59state-resident count only
Data types: Government IDFinancial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Attorney General Michael A. Delaney

During the incident: Stopped using the database for marketing efforts
Retained an expert computer database firm (Kroll Advisory Solutions) to assist in finding and removing guest information
Conducted exhaustive forensic analysis of the database
Instituted new controls that further restrict the use of the database
Changes made: Conducted a comprehensive internal review of its practices and procedures related to securing the privacy and confidentiality of personal information
Offered one year of free credit monitoring through TransUnion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(146 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 25 · first · this page

California State AG+1d

Massachusetts State AG+5d

Pattern: first filing Apr 25 (NH), last Apr 30 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/choice-hotels-20120425.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2012
Raw hash: f4fbcd044fe9e3b9d6a902b9bbe3ddf6edaaeb89a145302ba2bba73a874f26b7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCHOICE HOTELS INTERNATIONAL INC /DE

Victim entityCHOICE HOTELS INTERNATIONAL INC /DE

Incidentdiscovered Dec 1, 2011

Stated responseStopped using the database for marketing efforts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov