AccidentalHospitalityHospitalityMisconfigurationCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumResolved

CHOICE HOTELS INTERNATIONAL INC /DE

bd_bdb37959843ab45e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 12, 2019

Filed

Nov 29, 2019

To disclose

17 days

Affected

88,000

Linked

7 filings

Confidence

65%

Full breach record for CHOICE HOTELS INTERNATIONAL INC /DE →3 incidents on file

Choice Hotels International disclosed an inadvertent data exposure affecting approximately 88,000 guests between June 2015 and November 2019. A technical issue with the Safari web browser caused reservation data (name, email, payment card number, expiration date, and potentially CVV) to be included in website URLs, which were then sent to third-party tracking services. The issue was identified and resolved on November 12, 2019, by modifying website code. Third parties were contacted to delete the data.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 12, 2019 → Notified Nov 29, 201917d ✓ CA 60-day OK17 days discovery → filing

Incident timeline

undetected · 1625 days

discovery → filing · 17 days

Jun 1, 2015

Begins

Nov 12, 2019

Discovered

Nov 29, 2019

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Oregon State AGbd_7a0f208daa634ba82019-11-29Candidate
Massachusetts State AGbd_a56e87e2a63c96dc2019-11-29Verified
Montana State AGbd_d69bfb5a1239ad622019-11-29Verified
Washington State AGbd_ff0c6471398ec38b2019-11-29Verified

Show 2 more filings ↓up to 4d gap

New Hampshire State AGbd_704663f4ed3706e62019-12-02 · +3dVerified
South Carolina State AGbd_32d8e054e035a1942019-12-03 · +4dVerified

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com

Name: CHOICE HOTELS INTERNATIONAL INC /DE
norm: choice hotels international inc de
Domain: choicehotels.com
Industry: Hospitalityllm

Discovered: Nov 12, 2019
Breach occurred: Jun 1, 2015 – Nov 12, 2019
Undetected for: 1,625 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 29, 2019
Affected individuals: 88,000nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration

During the incident: Made changes to the code that operates our website to override how Safari responds after a crash
Contacting the third-party companies we work with to ask them to delete any data they may have
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: CA 60-day OK · 17d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 12, 2019
→ Notified: Nov 29, 2019
17d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 12, 2019 → Notified: Nov 29, 2019	17d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Oregon State AGNov 29 · first

Massachusetts State AGNov 29 · first

Montana State AGNov 29 · first

Washington State AGNov 29 · first

California State AGNov 29 · first · this page

New Hampshire State AG+3d

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-184744
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 29, 2019
Raw hash: 35129ced8bf01793e4a074f71f37af28b4dfc7a5cd62ae64878b202bef2f20ef

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCHOICE HOTELS INTERNATIONAL INC /DE

Victim entityCHOICE HOTELS INTERNATIONAL INC /DE

Incidentdiscovered Nov 12, 2019

Stated responseMade changes to the code that operates our website to override how Safari responds after a crash

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov