HackingTechnologyRetail & ConsumerInformationVulnerability ExploitCapture Stored DataData ExfiltratedTargetedDelayed DiscoveryPIIFinancial accountIdentity (basic)LowContained

Resort Data Processing

bd_8b312adb02cdb175 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 14, 2021

Filed

Jul 27, 2021

To disclose

6 weeks

Affected

37state residents only

Linked

10 filings

Confidence

65%

Full breach record for Resort Data Processing →4 incidents on file

Resort Data Processing, Inc. notified Montana AG of a cybersecurity attack on its online booking system. Malicious activity occurred from Jan 2019 to June 2021. Attackers used malicious code to acquire credit/debit card info. Disclosed June 14, 2021. Notices sent July 23, 2021. Forensic firm engaged; patch deployed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 865 days

discovery → filing · 6 weeks / 43 days

Jan 31, 2019

Begins

Jun 14, 2021

Discovered

Jul 27, 2021

Filed

vs. sector median

12 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Montana State AGbd_26e0d8d5acfcd4f82021-07-23 · +4dVerified
Massachusetts State AGbd_9f4b7050f82829782021-07-23 · +4dVerified
Montana State AGbd_ccfadf2ce48081122021-07-23 · +4dVerified
Oregon State AGbd_7ff3dec2010370682021-07-22 · +5dVerified

Show 5 more filings ↓up to 13d gap

New Hampshire State AGbd_8d365a8625c524b12021-07-22 · +5dVerified
California State AGbd_9dcdd5d44158e3b02021-07-22 · +5dVerified
Maine State AGbd_32db99b757ca2d672021-07-14 · +13dCandidate
Indiana State AGbd_602f99f557079f092021-07-14 · +13dVerified
Washington State AGbd_78e25fe4ecbfdb012021-07-14 · +13dVerified

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: Jun 14, 2021
Breach occurred: Jan 31, 2019 – Jun 14, 2021
Undetected for: 865 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 23, 2021
Affected individuals: 37state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Terminated the attackers’ access
Developed and deployed a security patch
Enlisted a leading cybersecurity forensics firm to assist us in fully investigating the incident
Changes made: Fixed the software vulnerability
Consulting with cybersecurity experts to identify and implement additional controls to further enhance our online booking system’s security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

Maine State AGJul 14 · first

Indiana State AGJul 14 · first

Washington State AGJul 14 · first

Oregon State AG+8d

New Hampshire State AG+8d

California State AG+8d

Montana State AG+9d

Massachusetts State AG+9d

Montana State AG+9d

Montana State AG+13d · this page

Pattern: first filing Jul 14 (ME), last Jul 27 (MT) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2021
Raw hash: d4b8cfa52ab05db06f961f41f0241ab2c72a83da2c2701e199075faf64942c78

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityResort Data Processing

Victim entityResort Data Processing

Incidentdiscovered Jun 14, 2021

Stated responseTerminated the attackers’ access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov