MalwareHospitalityHospitalityRansomwareData ExfiltratedCustomer Data InvolvedPCIFinancial accountIdentity (basic)LowActive

Milestone Hospitality Management, LLC

bd_83b5a386d211902b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 22, 2015

Filed

Aug 14, 2015

To disclose

23 days

Affected

15state residents only

Linked

2 filings

Confidence

64%

Full breach record for Milestone Hospitality Management, LLC →

Milestone Hospitality Management, LLC reported a malware incident affecting the Holiday Inn Harrisburg/Hershey property management system. Malware was present from June 2 to July 10, 2015, compromising credit card data (name, address, account number, expiration, CVV) of 15 New Hampshire residents. Discovery occurred on July 22, 2015. Notices were sent August 14, 2015, including credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 23 days

Jun 2, 2015

Begins

Jul 22, 2015

Discovered

Aug 14, 2015

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9db5e48cd7be7c4e2015-08-18 · +4dVerified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Milestone Hospitality Management, LLC
norm: milestone hospitality management
Industry: Hospitalityllm

Discovered: Jul 22, 2015
Breach occurred: Jun 2, 2015 – Jul 10, 2015
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 14, 2015
Affected individuals: 15state-resident count only
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Providing notice to New Hampshire Attorney GeneralProviding notice to other state and provincial regulators

During the incident: Launched an investigation to determine the nature and scope of the incident
Reported this incident to its processor and the hotel franchisor
Third-party forensic investigators assisted in the investigation
Providing individuals with information on how to better protect against identity theft or fraud
Providing access to free year of credit monitoring and identity restoration services with Experian
Reviewing its systems, policies and procedures to better protect against an incident like this from happening again
Providing notice of this incident to other state and provincial regulators, and consumer reporting agencies
Changes made: Reviewing its systems, policies and procedures to better protect against an incident like this from happening again
Taking steps to remediate this issue and enhance the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGAug 14 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/milestone-hospitality-20150814.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2015
Raw hash: 550559fac20026e2db31a38d58608e762a1ff394fcd1aa8d87143306c3de63ac

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityMilestone Hospitality Management, LLC

Incidentdiscovered Jul 22, 2015

Stated responseLaunched an investigation to determine the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov