HackingHospitalityHospitalityCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

The Watergate Hotel

bd_da54ff47e18b530d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2024

Filed

Feb 7, 2025

To disclose

44 weeks

Affected

633state residents only

Linked

6 filings

Confidence

67%

Full breach record for The Watergate Hotel →3 incidents on file

The Watergate Hotel notified Maryland AG of a data event affecting 633 residents. On April 6, 2024, an unknown actor accessed systems, viewing/downloading files containing PII, SSNs, driver's licenses, payment card info, and medical data. Watergate secured systems, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d44 weeks discovery → filing

Incident timeline

discovery → filing · 44 weeks / 307 days

Apr 6, 2024

Discovered

Feb 7, 2025

Filed

This filing is one of 6 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 307 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Nebraska State AGbd_1fee560fb8408d632025-02-07Verified
Indiana State AGbd_268a22cc687049972025-02-07Verified
Maine State AGbd_2d394bbe8aebc5382025-02-07Verified
Massachusetts State AGbd_46696151d2efdbef2025-02-07Verified

Show 1 more filing ↓

Vermont State AGbd_d1718365e663f72f2025-02-07Verified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: The Watergate Hotel
norm: the watergate hotel
Domain: thewatergatehotel.com
Industry: Hospitalityllm

Discovered: Apr 6, 2024
Materiality determined: —
Notification sent: Feb 7, 2025
Affected individuals: 633state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Maryland Attorney GeneralNotified federal law enforcement

During the incident: Took steps to secure its environment
Launched an investigation into the nature and scope of the activity
Undertook a comprehensive review of the files determined to be at risk
Notified federal law enforcement regarding the event
Implemented additional security measures
Provided individuals whose personal information was potentially affected with access to credit monitoring services for twelve (12) months through Experian at no cost
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice of this incident to state regulators
Provided written notice to the three major credit reporting agencies: Equifax, Experian, and TransUnion
Changes made: Reviewed security policies and procedures to reduce the risk of similar future events
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(307 days from discovery to filing)
Compliance flags: MD AG >90dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGFeb 7 · first

Indiana State AGFeb 7 · first

Maine State AGFeb 7 · first

Massachusetts State AGFeb 7 · first

Vermont State AGFeb 7 · first

Maryland State AGFeb 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376338.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 7, 2025
Raw hash: e0a94c689d64f8d9bf79d21be3c644762ab503355680d62d78e4a0dd938d16bb

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityThe Watergate Hotel

Incidentdiscovered Apr 6, 2024

Stated responseTook steps to secure its environment

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov