MalwareHospitalityHospitalityInfostealerData ExfiltratedTargetedPCIIdentity (basic)LowContained

Rosen Hotels & Resorts

bd_cc33a49c08666b86 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 3, 2016

Filed

Mar 4, 2016

To disclose

4 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Rosen Hotels & Resorts →

Rosen Hotels & Resorts Inc. notified the NH Attorney General of a payment card malware incident. Malware installed in the card network stole cardholder name, number, expiration, and verification codes from guests who stayed between Sept 2, 2014 and Feb 18, 2016. Notifications were sent March 4, 2016. No specific count of affected individuals was disclosed in this filing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 519 days

discovery → filing · 4 weeks / 30 days

Sep 2, 2014

Begins

Feb 3, 2016

Discovered

Mar 4, 2016

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_4f7660b0923ac5ed2016-03-04Candidate
California State AGbd_b16dffb998cfb4002016-03-04Verified
Massachusetts State AGbd_5b489425d8f6ac392016-03-08 · +4dVerified

Name: BakerHostetler LLP
norm: bakerhostetler
Domain: rosenhotels.com

Name: Rosen Hotels & Resorts
norm: rosen hotels resorts
Domain: rosenhotels.com
Industry: Hospitalityllm

Discovered: Feb 3, 2016
Breach occurred: Sep 2, 2014 – Feb 18, 2016
Undetected for: 519 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2016
Affected individuals: Not disclosed
Data types: PCIIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Hired a leading cyber security firm to examine its payment card processing system
Coordinating efforts with law enforcement and the payment card networks
Working with the payment card networks to identify the potentially affected cards
Supporting law enforcement’s investigation
Established a dedicated helpline
Changes made: Additional, enhanced security measures have been implemented to help prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMar 4 · first

California State AGMar 4 · first

New Hampshire State AGMar 4 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rosen-hotels-20160304.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2016
Raw hash: 9c561063cfab94b6d61542b3903c5a53b0fd2c65fa3d9a9e5ae31eaa8f0a2844

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBakerHostetler LLP

Victim entityRosen Hotels & Resorts

Incidentdiscovered Feb 3, 2016

Stated responseHired a leading cyber security firm to examine its payment card processing system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov