HackingHospitalityHospitalityStolen CredentialsCustomer Data InvolvedGovernment IDFinancial accountHealth (basic)PIIMediumContained

Towne Vacations Deep Creek, LLC

bd_7265931baa54e926 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 11, 2024

Filed

Feb 20, 2025

To disclose

19 weeks

Affected

289state residents only

Linked

3 filings

Confidence

67%

Full breach record for Towne Vacations Deep Creek, LLC →

Towne Vacations Deep Creek, LLC (t/a Railey Vacations) notified the Maryland AG of a security incident discovered on October 11, 2024, involving unauthorized access to an employee's email account. The incident affected 289 Maryland residents, exposing SSNs, driver's licenses, passport numbers, financial account details, and clinical/treatment information. The company engaged third-party cybersecurity specialists, notified affected individuals, and offered 24 months of identity protection services.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d19 weeks discovery → filing

Incident timeline

discovery → filing · 19 weeks / 132 days

Oct 11, 2024

Discovered

Feb 20, 2025

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_6c60c31a6bb4de852025-02-20Verified
Indiana State AGbd_ee898730124090c22025-02-20Verified

Name: Towne Vacations Deep Creek, LLC
norm: towne vacations deep creek

Name: Towne Vacations Deep Creek, LLC
norm: towne vacations deep creek
Industry: Hospitalityllm

Discovered: Oct 11, 2024
Materiality determined: —
Notification sent: Feb 20, 2025
Affected individuals: 289state-resident count only
Data types: Government IDFinancial accountHealth (basic)PII
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maryland Attorney General
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists
Began notifying potentially affected individuals via mailed letter
Offering 24 months of complimentary identity protection services through Equifax CompleteTM Premier
Call center is currently open and available to address any inquiries
Changes made: Amending its administrative safeguards (such as protocols, practices, procedures, and policies)
Amending its technological safeguards
Updating its employee training materials
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(132 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 20 · first

Indiana State AGFeb 20 · first

Maryland State AGFeb 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376390.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2025
Raw hash: 174d5b7218a7d02f0195324dd0fef1ffa2c12cf04a2b368cb2ca0961410f6626

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTowne Vacations Deep Creek, LLC

Victim entityTowne Vacations Deep Creek, LLC

Incidentdiscovered Oct 11, 2024

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov