MalwareHospitalityHospitalityRansomwareData EncryptedTargetedFinancial accountFinancial credentialsLowResolved

Omni Hotels & Resorts

bd_a019f9ceeadb8429 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 30, 2016

Filed

Jul 8, 2016

To disclose

6 weeks

Affected

316state residents only

Linked

7 filings

Confidence

66%

Full breach record for Omni Hotels & Resorts →2 incidents on file

Omni Hotels and Resorts notified the Washington AG of a malware attack on POS systems affecting payment card data (card numbers, CVV, expiration). Malware operated between Dec 2015 and June 2016. 316 WA residents affected. Incident resolved; law enforcement notified; 1-year identity theft protection offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 159 days

discovery → filing · 6 weeks / 39 days

Dec 23, 2015

Begins

May 30, 2016

Discovered

Jul 8, 2016

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_4c5995772220623a2016-07-08Verified
California State AGbd_870a61eb6495f3242016-07-08Verified
Montana State AGbd_ef2dadbfc98e5e4e2016-07-08Candidate
New Hampshire State AGbd_d902373a812a8f2d2016-07-07 · +1dVerified

Show 2 more filings ↓up to 13d gap

South Carolina State AGbd_6bb224b4a8d4ca762016-07-13 · +5dVerified
Oregon State AGbd_a32dcecca74361ad2016-07-21 · +13dVerified by operator

Name: Omni Hotels & Resorts
norm: omni hotels resorts
Domain: omnihotels.com

Name: Omni Hotels & Resorts
norm: omni hotels resorts
Domain: omnihotels.com
Industry: Hospitalityllm

Discovered: May 30, 2016
Breach occurred: Dec 23, 2015 – Jun 14, 2016
Undetected for: 159 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 8, 2016
Affected individuals: 316state-resident count only
Data types: Financial accountFinancial credentials
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General of Washington

During the incident: Engaged leading IT investigation and security firms approved by the major credit card companies to determine the facts and contain the intrusion
Contacted law enforcement and is cooperating with its investigation
Offering one year of free identity theft protection and repair to all affected individuals
Providing written notice, electronic notice, media notification, and posting a notice to its website
Changes made: Taken steps to further strengthen its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGJul 7 · first

Massachusetts State AG+1d

California State AG+1d

Montana State AG+1d

Washington State AG+1d · this page

South Carolina State AG+6d

Oregon State AG+14d

Pattern: first filing Jul 7 (NH), last Jul 21 (OR) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9631.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2016
Raw hash: 684d144ef85a85c9ec3c21b2ab032d33d860279411ee8c7c30879ee613c459b6

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityOmni Hotels & Resorts

Victim entityOmni Hotels & Resorts

Incidentdiscovered May 30, 2016

Stated responseEngaged leading IT investigation and security firms approved by the major credit card companies to determine the facts and contain the intrusion

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com