HackingHospitalityHospitalityTargetedCustomer Data InvolvedIdentity (basic)Government IDPIIHighContained

Hudson River Partners I L.P.

bd_7e2139f3f98129d0 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 17, 2025

Filed

Nov 3, 2025

To disclose

17 days

Affected · nationwide

33,05386 in this filing

Linked

11 filings

Confidence

66%

Full breach record for Hudson River Partners I L.P. →

Hudson River Partners I L.P. dba The Thayer Hotel reported an external system breach (hacking) on September 19, 2025, discovered on October 17, 2025. The incident affected 33,053 individuals nationwide, including 86 Maine residents. Exposed data included names combined with driver's license, passport, DOB, and SSNs. The company engaged forensic specialists, notified law enforcement, and offered 12 months of credit monitoring via Kroll Security.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 17, 2025 → Filed with AG Nov 3, 202517d ✓ ME AG ≤30d17 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 28 days

discovery → filing · 17 days

Sep 19, 2025

Begins

Oct 17, 2025

Discovered

Nov 3, 2025

Filed

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_12aa427de683d4752025-11-03Verified
Indiana State AGbd_5ff7442183fae9c42025-11-03Verified
Nebraska State AGbd_865aea85ac9a92842025-11-03Verified
Massachusetts State AGbd_dedd83364d9f23632025-11-03Verified

Show 6 more filings ↓up to 3d gap

Nebraska State AGbd_ebafb05ebc7ff7242025-11-03Verified
Vermont State AGbd_fed038a81b8b76ac2025-11-03Verified
Texas State AGbd_d48218c6d02db3462025-11-04 · +1dVerified
New Hampshire State AGbd_21fe280fdcbdc5b02025-11-05 · +2dVerified
Illinois State AGbd_9f4989b24d7d4ab92025-11-01 · +2dVerified
Montana State AGbd_8009cd56be9477b82025-10-31 · +3dCandidate

Name: Hudson River Partners I L.P.
norm: hudson river partners i
Domain: thethayerhotel.com

Name: Hudson River Partners I L.P.
norm: hudson river partners i
Domain: thethayerhotel.com
Also named: Hudson River Partners I L.P.dba oflegal entity
The Thayer Hoteldba oftrade name
Industry: Hospitalityllm

Discovered: Oct 17, 2025
Breach occurred: Sep 19, 2025
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 3, 2025
Affected individuals: 33,053state + nationwide
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notifying appropriate regulators and others as required by governing law
Initial access: exploit_public_facing

During the incident: Recovered from the event, including restoring our own access to our systems
Secured our systems against similar events
Notified law enforcement
Launched an investigation with the assistance of third-party forensic specialists and cybersecurity professionals
Changes made: Secured the services of Kroll Security to provide credit monitoring services
Implementing additional safety measures to prevent a recurrence
Continually evaluate and modify practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: ME AG ≤30d · 17d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 17, 2025
→ Filed with AG: Nov 3, 2025
17d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 17, 2025 → Filed with AG: Nov 3, 2025	17d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Montana State AGOct 31 · first

Illinois State AG+1d

California State AG+3d

Indiana State AG+3d

Nebraska State AG+3d

Massachusetts State AG+3d

Nebraska State AG+3d

Vermont State AG+3d

Maine State AG+3d · this page

Texas State AG+4d

New Hampshire State AG+5d

Pattern: first filing Oct 31 (MT), last Nov 5 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7e4378c2-4c0b-44b3-b99b-7d80fa619e86.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2025
Raw hash: 4d4a32bd98d9c10f05b823dfc78f9aca3bec29565b61c3052e31964285e06165

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityHudson River Partners I L.P.

Victim entityHudson River Partners I L.P.

Incidentdiscovered Oct 17, 2025

Stated responseRecovered from the event, including restoring our own access to our systems

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov