Social EngineeringHospitalityHospitalityPhishingStolen CredentialsCustomer Data InvolvedSupply Chain (3P Vendor)PIILowContained

Hotel Vermont

bd_e3d45b37805663c5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 11, 2021

Filed

Apr 6, 2021

To disclose

26 days

Affected · nationwide

1407 in this filing

Linked

2 filings

Confidence

75%

Full breach record for Hotel Vermont →

Hotel Vermont, a hospitality company, reported a data breach affecting 7 Maine residents. The breach occurred when an employee's credentials for a third-party online reservation service, TravelClick, were compromised through a phishing email on January 21, 2021. A cybercriminal, posing as a TravelClick representative, used the stolen credentials to access guest reservation information within TravelClick's database. The breach was discovered on March 11, 2021, and affected individuals were notified on April 6, 2021.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 11, 2021 → Filed with AG Apr 6, 202126d ✓ ME AG ≤30d26 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 49 days

discovery → filing · 26 days

Jan 21, 2021

Begins

Mar 11, 2021

Discovered

Apr 6, 2021

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_a609dc9272cfecb12021-04-06Verified

Name: Hotel Vermont
norm: hotel vermont

Name: Hotel Vermont
norm: hotel vermont
Industry: Hospitalityllm

Discovered: Mar 11, 2021
Breach occurred: Jan 21, 2021
Undetected for: 49 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2021
Affected individuals: 140state + nationwide
Data types: PII
Attack vector: Phishing
Threat actor: External

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: ME AG ≤30d · 26d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 11, 2021
→ Filed with AG: Apr 6, 2021
26d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 11, 2021 → Filed with AG: Apr 6, 2021	26d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 6 · first

Maine State AGApr 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b8a76763-1e8d-47e5-90f5-ac98655ccc5c.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2021
Raw hash: fa7a679e44ef6faf4224a9414993be8b1f48268c1281b959539f814f2dc073d6

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHotel Vermont

Victim entityHotel Vermont

Incidentdiscovered Mar 11, 2021

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov