HackingTechnologyInformationVulnerability ExploitData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountLowContained

Resort Data Processing

bd_8d365a8625c524b1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 14, 2021

Filed

Jul 22, 2021

To disclose

5 weeks

Affected

59state residents only

Linked

10 filings

Confidence

66%

Full breach record for Resort Data Processing →4 incidents on file

Resort Data Processing, Inc. (RDP) notified the New Hampshire Attorney General of a cybersecurity attack on its online booking engine. Attackers exploited a vulnerability to exfiltrate credit/debit card data, names, and contact info from approximately 59 NH residents. The incident occurred between Feb 22, 2021, and June 14, 2021. RDP terminated access, deployed a security patch, and engaged forensic investigators.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 112 days

discovery → filing · 5 weeks / 38 days

Feb 22, 2021

Begins

Jun 14, 2021

Discovered

Jul 22, 2021

Filed

vs. sector median

13 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_7ff3dec2010370682021-07-22Verified
California State AGbd_9dcdd5d44158e3b02021-07-22Verified
Montana State AGbd_26e0d8d5acfcd4f82021-07-23 · +1dVerified
Massachusetts State AGbd_9f4b7050f82829782021-07-23 · +1dVerified

Show 5 more filings ↓up to 8d gap

Montana State AGbd_ccfadf2ce48081122021-07-23 · +1dVerified
Montana State AGbd_8b312adb02cdb1752021-07-27 · +5dVerified
Maine State AGbd_32db99b757ca2d672021-07-14 · +8dCandidate
Indiana State AGbd_602f99f557079f092021-07-14 · +8dVerified
Washington State AGbd_78e25fe4ecbfdb012021-07-14 · +8dVerified

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com

Name: Resort Data Processing
norm: resort data processing
Domain: resortdata.com
Industry: Technologyllm

Discovered: Jun 14, 2021
Breach occurred: Feb 22, 2021 – Jun 14, 2021
Undetected for: 112 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 23, 2021
Affected individuals: 59state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Terminated the attackers’ access
Developed and deployed a security patch
Hired a leading cybersecurity forensics firm to fully investigate the incident
Changes made: Fixed the software vulnerability
Consulting with cybersecurity experts to identify and implement additional controls to further enhance our online booking system’s security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

Maine State AGJul 14 · first

Indiana State AGJul 14 · first

Washington State AGJul 14 · first

Oregon State AG+8d

California State AG+8d

New Hampshire State AG+8d · this page

Montana State AG+9d

Massachusetts State AG+9d

Montana State AG+9d

Montana State AG+13d

Pattern: first filing Jul 14 (ME), last Jul 27 (MT) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/resort-data-processing-20210722.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2021
Raw hash: b672ae0c1ec50f335e52c4ee730fd370f69953bee077e2e44ae718e11d5a2162

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityResort Data Processing

Victim entityResort Data Processing

Incidentdiscovered Jun 14, 2021

Stated responseTerminated the attackers’ access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov