HackingHospitalityHospitalityStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountPCILowContained

Sentinel Hotel

bd_c65a59af32eb4741 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 5, 2016

Filed

Nov 4, 2016

To disclose

4 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Sentinel Hotel →

Sentinel Hotel notified NH AG of a breach affecting 1 resident. Unauthorized software on a front-desk payment terminal copied card data (name, account, expiry, CVV) from July 12 to Oct 3, 2016. Discovered Oct 5, 2016. Notices sent Nov 4, 2016. Law enforcement notified; security firm engaged.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 85 days

discovery → filing · 4 weeks / 30 days

Jul 12, 2016

Begins

Oct 5, 2016

Discovered

Nov 4, 2016

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_86cb84feddfd81e32016-11-04Verified
Oregon State AGbd_8f24a8fe27098e172016-11-04Candidate
Montana State AGbd_ef822cbaf636dbd52016-11-04Verified

Name: Sentinel Hotel
norm: sentinel hotel

Name: Sentinel Hotel
norm: sentinel hotel
Industry: Hospitalityllm

Discovered: Oct 5, 2016
Breach occurred: Jul 12, 2016 – Oct 3, 2016
Undetected for: 85 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 4, 2016
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial accountPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical MediumT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: external_remote_services

During the incident: Launched an investigation
Hired a leading computer security firm to assist
Established a dedicated call center
Stopped the incident
Notified law enforcement
Changes made: Work with the computer security firm to further strengthen the security of its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGNov 4 · first

Oregon State AGNov 4 · first

Montana State AGNov 4 · first

New Hampshire State AGNov 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sentinel-hotel-20161104.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 4, 2016
Raw hash: 72b563f39c1c33fe112e938c933153d5cfc492d7d7971b9f2549da154ce2d5dc

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySentinel Hotel

Victim entitySentinel Hotel

Incidentdiscovered Oct 5, 2016

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov