MalwareHospitalityHospitalityRansomwareData ExfiltratedCustomer Data InvolvedPCIFinancial accountIdentity (basic)MediumContained

Six Continents Hotels

bd_d66a216b1857d426 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2017

Filed

Apr 14, 2017

To disclose

15 weeks

Affected

3,956state residents only

Linked

7 filings

Confidence

66%

Full breach record for Six Continents Hotels →2 incidents on file

IHG notified NH AG of malware at franchise hotels (Sept-Dec 2016) stealing payment card track data. 3,956 NH residents affected. Malware eradicated; law enforcement notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 94 days

discovery → filing · 15 weeks / 103 days

Sep 29, 2016

Begins

Jan 1, 2017

Discovered

Apr 14, 2017

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_4a76c7e03c62e29d2017-04-14Verified
Massachusetts State AGbd_8c134423752fa0372017-04-14Verified
California State AGbd_8ef72d261a0a28c02017-04-14Verified
Washington State AGbd_bf6597d4b90e06332017-04-14Verified

Show 2 more filings ↓up to 70d gap

Oregon State AGbd_da3308682a4d4c2c2017-04-14Verified
California State AGbd_3d49f29564c392be2017-02-03 · +70dCandidate

Name: InterContinental Hotels Group
norm: intercontinental hotels group
Domain: ihg.com

Name: Six Continents Hotels
norm: six continents hotels
Industry: Hospitalityllm

Discovered: Jan 1, 2017
Breach occurred: Sep 29, 2016 – Dec 29, 2016
Undetected for: 94 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 14, 2017
Affected individuals: 3,956state-resident count only
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: external_remote_services

During the incident: Hired a leading cyber security firm on behalf of franchisees to coordinate an examination of the payment card processing systems
Established a dedicated call center
Working closely with the payment card networks
Law enforcement has also been notified
Changes made: Confirmed that the malware has been eradicated
Evaluated ways for franchisees to enhance security measures
Implemented IHG's Secure Payment Solution (SPS) at affected locations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

California State AGFeb 3 · first

Montana State AG+70d

Massachusetts State AG+70d

California State AG+70d

Washington State AG+70d

Oregon State AG+70d

New Hampshire State AG+70d · this page

Pattern: first filing Feb 3 (CA), last Apr 14 (NH) — a 70-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/intercontinental-hotels-20170414.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2017
Raw hash: 6ebe6c26e55d6ad76f299bb20ceb2b6ba44d79e76d9843677568de41b60c4a63

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityInterContinental Hotels Group

Victim entitySix Continents Hotels

Incidentdiscovered Jan 1, 2017

Stated responseHired a leading cyber security firm on behalf of franchisees to coordinate an examination of the payment card processing systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov