HackingHospitalityHospitalityStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)HighActive

Pyramid Advisors Limited Partnership

bd_752e0e4ad4f9827a · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 14, 2025

Filed

Feb 25, 2026

To disclose

28 weeks

Affected

3,434state residents only

Linked

3 filings

Confidence

69%

Pyramid Advisors Limited Partnership d/b/a Pyramid Global Hospitality notified Washington AG of unauthorized access to its network on August 14, 2025. The incident impacted current and former employee data, including names, SSNs, driver's licenses, financial account info, and health/medical information. 3,434 Washington residents were affected. Pyramid engaged forensic specialists, notified law enforcement, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d28 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 28 weeks / 195 days

Aug 13, 2025

Begins

Aug 14, 2025

Discovered

Feb 25, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteworldleaksbd_aa49c5d85f3de9502025-08-13 · +196dVerified by operator

Regulatory filings (1) · sorted by filing gap

South Carolina State AGbd_6ea22598deacc8492026-02-25Verified by operator

Name: Pyramid Advisors Limited Partnership
norm: pyramid advisors
Domain: pyramidglobal.com

Name: Pyramid Advisors Limited Partnership
norm: pyramid advisors
Domain: pyramidglobal.com
Industry: Hospitalityllm

Discovered: Aug 14, 2025
Breach occurred: Aug 13, 2025 – Aug 14, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 29, 2025
Affected individuals: 3,434state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberPassport numberHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified relevant state regulatorsNotified federal law enforcement
Initial access: valid_credentials

During the incident: Launched an investigation into the nature and scope of the event with the assistance of third-party forensic specialists
Began a comprehensive review of the impacted data with the assistance of a third- party specialist
Provided preliminary notice of this event to its employees on October 29, 2025
Offered free credit monitoring
Enhancing administrative and technical safeguards
Providing additional employee training
Offering credit monitoring and identity restoration services through IDX at no cost
Notified relevant state regulators and federal law enforcement
Notified the consumer reporting agencies including Experian, Equifax, and TransUnion
Changes made: Enhancing administrative and technical safeguards
Providing additional employee training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(195 days from discovery to filing)
Compliance flags: Leak >180dWA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

South Carolina State AGFeb 25 · first

Washington State AGFeb 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36808.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2026
Raw hash: cf594482eea68c6230967b61dab4418828ad8076722b43f46b72a22e05cf47b8

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityPyramid Advisors Limited Partnership

Victim entityPyramid Advisors Limited Partnership

Incidentdiscovered Aug 14, 2025

Stated responseLaunched an investigation into the nature and scope of the event with the assistance of third-party forensic specialists

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com