MalwareInfostealerSupply Chain (3P Vendor)Data ExfiltratedFINANCIAL_ACCOUNTIDENTITY_BASICLowContained
HEI Hotels & Resorts
bd_de8180f36bdf0951 · schema v1 · pii pii-v1
Full breach record for HEI Hotels & Resorts →HEI Hotels & Resorts notified California AG of a security incident affecting payment card data (account numbers, expiration, verification codes) at multiple properties between March 2015 and June 2016. Malicious software installed on payment processing systems captured data. Incident contained; forensic experts engaged; law enforcement notified.
California clockDiscovered Jun 21, 2016 → Notified Aug 12, 201652d ✓ CA 60-day OK7 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_0f26bbce75cef0d1Montana State AGfiled 2016-08-12Candidate
- bd_4c86346afddc039dNew Hampshire State AGfiled 2016-08-12Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-63346
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 12, 2016
- Raw hash
- 5553149ce4ede5161420683e767dbc0ef13969176f00a271da056d80861b7717
Reporting entity
- Name
- HEI Hotels & Resortsnorm: hei hotels resorts
Victim entity
- Name
- HEI Hotels & Resortsnorm: hei hotels resorts
Incident
- Discovered
- Jun 21, 2016
- Materiality determined
- —
- Notification sent
- Aug 12, 2016
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1056 Input CaptureT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Contacted law enforcement
- Initial access
- supply_chain
Compliance
- Time to disclose
- 7 weeks(52 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 52d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 21, 2016→ Notified: Aug 12, 201652d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.