HackingHospitalityHospitalityStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountFinancial credentialsLowContained

Noble House Hotels & Resorts

bd_b13c38642c8c54f7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2016

Filed

Aug 24, 2016

To disclose

29 days

Affected

13state residents only

Linked

9 filings

Confidence

66%

Full breach record for Noble House Hotels & Resorts →3 incidents on file

Noble House Hotels & Resorts notified the New Hampshire Attorney General on August 24, 2016, regarding a payment card system compromise at Ocean Key Resort & Spa. Unauthorized access occurred between April 26 and June 8, 2016, potentially affecting 13 New Hampshire residents. Compromised data included payment card numbers, expiration dates, and CVV numbers. The company engaged a security firm, established a call center, and provided substitute notification via website postings and press releases.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 91 days

discovery → filing · 29 days

Apr 26, 2016

Begins

Jul 26, 2016

Discovered

Aug 24, 2016

Filed

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Montana State AGbd_236fd75e6467b7742016-08-24Candidate
Massachusetts State AGbd_b32d17dcc8a377e72016-08-24Verified
Massachusetts State AGbd_742fd0ea77ecc86f2016-09-02 · +9dVerified
Washington State AGbd_7f17a96003d1419e2016-09-02 · +9dVerified

Show 4 more filings ↓up to 9d gap

Montana State AGbd_81a86fd722a970602016-09-02 · +9dVerified
California State AGbd_a22708c9b9588dca2016-09-02 · +9dVerified
New Hampshire State AGbd_c2732f57322892f22016-09-02 · +9dVerified
Oregon State AGbd_f32c3b337703fea62016-09-02 · +9dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Noble House Hotels & Resorts
norm: noble house hotels resorts
Industry: Hospitalityllm

Discovered: Jul 26, 2016
Breach occurred: Apr 26, 2016 – Jun 8, 2016
Undetected for: 91 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 24, 2016
Affected individuals: 13state-resident count only
Data types: Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General (Joseph Foster)
Initial access: exploit_public_facing

During the incident: Engaged a computer security firm to examine its payment system
Established a dedicated call center to assist individuals
Provided substitute notification by posting a statement on the home page of its website and on a page of the website of Ocean Key Resort
Issued a press release
Changes made: Working with the computer security firm to ensure that this issue has been fully remediated
Reviewing and enhancing its security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

Montana State AGAug 24 · first

Massachusetts State AGAug 24 · first

New Hampshire State AGAug 24 · first · this page

Massachusetts State AG+9d

Washington State AG+9d

Montana State AG+9d

California State AG+9d

New Hampshire State AG+9d

Oregon State AG+9d

Pattern: first filing Aug 24 (MT), last Sep 2 (OR) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/noble-house-hotels-20160824.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 24, 2016
Raw hash: 1ccf781bf931e93912a52cf1ebfa079807037754d8ad35da61ef9a1ce189be99

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityNoble House Hotels & Resorts

Incidentdiscovered Jul 26, 2016

Stated responseEngaged a computer security firm to examine its payment system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov