HackingHospitalityHospitalityStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDCredentialsMediumResolved

ACCOR MANAGEMENT US INC.

bd_d8311640792a4944 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jul 11, 2026

Filed

Sep 30, 2026

To disclose

12 weeks

Affected

1state residents only

Confidence

68%

Full breach record for ACCOR MANAGEMENT US INC. →

Accor Management US Inc reported that a third-party service provider experienced a security incident exposing login credentials used to access Accor customer information. An unauthorized individual used these credentials to view customer data, including passport numbers, for one New Hampshire resident on July 11-12, 2026. Accor reset credentials and customer passwords, and notified affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 81 days

Jul 11, 2026

Begins

Jul 11, 2026

Discovered

Sep 30, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: ACCOR MANAGEMENT US INC.
norm: accor management us

Name: ACCOR MANAGEMENT US INC.
norm: accor management us
Industry: Hospitalityllm

Discovered: Jul 11, 2026
Breach occurred: Jul 11, 2026 – Jul 12, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 29, 2026
Affected individuals: 1state-resident count only
Data types: Government IDCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified foreign legal authorities
Third party: via third-party company
Initial access: supply_chain

During the incident: Initiated an investigation
Reset the third-party company's compromised credentials
Reset customer account passwords out of an abundance of caution
Notified foreign legal authorities
Notified customers that it was investigating this Incident on July 17, 2026
Sent follow up notifications to individuals potentially affected on September 29, 2026
Changes made: Continually evaluate and modify practices and internal controls to enhance privacy and security
Work with third-party service providers to ensure they handle Accor information with the same level of care
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(81 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/accor-management-us-20260930.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2026
Raw hash: c31a7821fdf1225e550dfadf22bfb59be21bd6aa916784a449a6fb3e07a11df5

Reporting entityACCOR MANAGEMENT US INC.

Victim entityACCOR MANAGEMENT US INC.

Incidentdiscovered Jul 11, 2026

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov