MalwareHospitalityHospitalityRansomwareCustomer Data InvolvedFinancial accountFinancial credentialsLowResolved

Omni Hotels & Resorts

bd_d902373a812a8f2d · schema v1 · pii pii-v1

Severity

Low

Discovered

May 30, 2016

Filed

Jul 7, 2016

To disclose

5 weeks

Affected

214state residents only

Linked

7 filings

Confidence

66%

Full breach record for Omni Hotels & Resorts →2 incidents on file

Omni Hotels and Resorts notified NH AG of malware on POS systems stealing payment card data (card numbers, CVV, expiration). Malware operated Dec 23, 2015–June 14, 2016. Discovered May 30, 2016. 214 NH residents affected. Notices sent July 8, 2016. Issue resolved; law enforcement notified; 1-year identity theft protection offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 159 days

discovery → filing · 5 weeks / 38 days

Dec 23, 2015

Begins

May 30, 2016

Discovered

Jul 7, 2016

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_4c5995772220623a2016-07-08 · +1dVerified
California State AGbd_870a61eb6495f3242016-07-08 · +1dVerified
Washington State AGbd_a019f9ceeadb84292016-07-08 · +1dVerified
Montana State AGbd_ef2dadbfc98e5e4e2016-07-08 · +1dCandidate

Show 2 more filings ↓up to 14d gap

South Carolina State AGbd_6bb224b4a8d4ca762016-07-13 · +6dVerified
Oregon State AGbd_a32dcecca74361ad2016-07-21 · +14dVerified by operator

Name: HAYNES AND BOONE LLP
norm: haynes and boone

Name: Omni Hotels & Resorts
norm: omni hotels resorts
Domain: omnihotels.com
Industry: Hospitalityllm

Discovered: May 30, 2016
Breach occurred: Dec 23, 2015 – Jun 14, 2016
Undetected for: 159 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 8, 2016
Affected individuals: 214state-resident count only
Data types: Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice Office of the Attorney General

During the incident: Engaged leading IT investigation and security firms approved by the major credit card companies to determine the facts and contain the intrusion
Contacted law enforcement and is cooperating with its investigation
Offering one year of free identity theft protection and repair to all affected individuals
Changes made: Taken steps to further strengthen its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGJul 7 · first · this page

Massachusetts State AG+1d

California State AG+1d

Washington State AG+1d

Montana State AG+1d

South Carolina State AG+6d

Oregon State AG+14d

Pattern: first filing Jul 7 (NH), last Jul 21 (OR) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/omni-hotels-20160707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2016
Raw hash: 69cc7df90ea5f2edd23286f6ab6782e545e90e18299f1f590d744f572ac98836

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityHAYNES AND BOONE LLP

Victim entityOmni Hotels & Resorts

Incidentdiscovered May 30, 2016

Stated responseEngaged leading IT investigation and security firms approved by the major credit card companies to determine the facts and contain the intrusion

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov