Social EngineeringHospitalityHospitalityPhishingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountLowContained

Nordic Village Resort

bd_c8df0b7ff6e2024a · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 2, 2020

Filed

May 27, 2020

To disclose

12 weeks

Affected · nationwide

262 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Nordic Village Resort →

Nordic Village Resort reported a phishing incident where an employee clicked a malicious link impersonating TravelClick's login portal. The attacker used stolen credentials to access reservation data for 26 guests between Feb 14 and Mar 2, 2020. Data exposed included names, contact info, and credit card numbers (no CVV/expiry). 2 NH residents were notified on May 26, 2020. Remediation included credential resets, employee training, and platform enhancements.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 17 days

discovery → filing · 12 weeks / 86 days

Feb 14, 2020

Begins

Mar 2, 2020

Discovered

May 27, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_ba5781ceced9326f2020-05-26 · +1dVerified

Name: Nordic Village Resort
norm: nordic village resort

Name: Nordic Village Resort
norm: nordic village resort
Industry: Hospitalityllm

Discovered: Mar 2, 2020
Breach occurred: Feb 14, 2020 – Mar 2, 2020
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 26, 2020
Affected individuals: 26state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Office of the Attorney General, Consumer Protection and Antitrust Bureau
Initial access: phishing_link

During the incident: Initiated a police report with local law enforcement authorities
Continues to assist law enforcement in their efforts and investigation
Third-party service provider immediately deactivated existing log-in / access information and issued new log-in credentials
Educated its employees and provided additional relevant training on how to identify and avoid “phishing” schemes
Offered all potentially affected guests a one-time reimbursement of up to Fifty Dollars ($50.00) for credit monitoring or security freeze services
Changes made: Continues working with its third-party providers and information technology vendors to enhance its internet and other secured platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 26 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nordic-village-resort-20200527.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 27, 2020
Raw hash: ad98942ec5a04dad662c9d4cfe4ed05a675f89c473765f53bc48f53c1f4037a7

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNordic Village Resort

Victim entityNordic Village Resort

Incidentdiscovered Mar 2, 2020

Stated responseInitiated a police report with local law enforcement authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov