HackingHospitalityHospitalityStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Financial accountLowContained

Rosewood Hotel Group

bd_d72d79c0ecf5814f · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 1, 2017

Filed

Jan 19, 2018

To disclose

7 weeks

Affected

5state residents only

Linked

4 filings

Confidence

66%

Full breach record for Rosewood Hotel Group →

Rosewood Hotel Group notified the NH AG of a third-party breach at Sabre Hospitality Solutions affecting guest names and payment card info. Unauthorized access occurred May 29, 2016 – Jan 11, 2017. Rosewood learned of the issue in late Dec 2017. 5 NH residents affected. Notifications sent Jan 19, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 551 days

discovery → filing · 7 weeks / 49 days

May 29, 2016

Begins

Dec 1, 2017

Discovered

Jan 19, 2018

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_103d1af78bdd1c9e2018-01-19Candidate
Montana State AGbd_a0605bf2789793b92018-01-19Verified
Massachusetts State AGbd_b1b00687687c79752018-01-19Verified

Name: Rosewood Hotel Group
norm: rosewood hotel

Name: Rosewood Hotel Group
norm: rosewood hotel
Industry: Hospitalityllm

Discovered: Dec 1, 2017
Breach occurred: May 29, 2016 – Jan 11, 2017
Undetected for: 551 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 19, 2018
Affected individuals: 5state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney General
Third party: via Sabre Hospitality Solutions
Initial access: trusted_relationship

During the incident: Rosewood quickly began working with Sabre to identify the affected Rosewood guests
Rosewood notified the relevant payment card brands of the issue
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGJan 19 · first

Montana State AGJan 19 · first

Massachusetts State AGJan 19 · first

New Hampshire State AGJan 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rosewood-hotel-group-20180119.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 19, 2018
Raw hash: 7b031e0f00b06adaa09a736d631760902c445f7fbc4221421264edbb087ae633

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRosewood Hotel Group

Victim entityRosewood Hotel Group

Incidentdiscovered Dec 1, 2017

Stated responseRosewood quickly began working with Sabre to identify the affected Rosewood guests

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov