Social EngineeringHospitalityHospitalityPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Aimbridge Hospitality Holdings, LLC

bd_e48eb334deda60f6 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 14, 2018

Filed

Jan 2, 2019

To disclose

16 weeks

Affected

17,381state residents only

Linked

6 filings

Confidence

66%

Full breach record for Aimbridge Hospitality Holdings, LLC →3 incidents on file

Aimbridge Hospitality Holdings, LLC experienced a phishing incident resulting in unauthorized access to employee email accounts between June 7, 2018, and September 24, 2018. The company discovered unusual activity on September 14, 2018. Personal information potentially accessed included names, Social Security numbers, financial account numbers, and driver's license numbers. Approximately 17,381 California residents were affected. The company reset passwords, implemented MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 14, 2018 → Notified Dec 31, 2018108d ✗ CA 60-day late16 weeks discovery → filing

Incident timeline

undetected · 99 days

discovery → filing · 16 weeks / 110 days

Jun 7, 2018

Begins

Sep 14, 2018

Discovered

Jan 2, 2019

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_91c48fafabf546932019-01-03 · +1dVerified
Massachusetts State AGbd_9530f0e8c007b1d22018-12-31 · +2dVerified
Oregon State AGbd_a7120229d278b1422018-12-31 · +2dCandidate
Montana State AGbd_bdeac05efe79abd22018-12-31 · +2dVerified

Show 1 more filing ↓up to 2d gap

Washington State AGbd_f19008c3ce0568512018-12-31 · +2dVerified

Name: Aimbridge Hospitality Holdings, LLC
norm: aimbridge hospitality

Name: Aimbridge Hospitality Holdings, LLC
norm: aimbridge hospitality
Industry: Hospitalityllm

Discovered: Sep 14, 2018
Breach occurred: Jun 7, 2018 – Sep 24, 2018
Undetected for: 99 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 31, 2018
Affected individuals: 17,381state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Launched an investigation into the unusual activity
Engaged computer forensics experts
Reset passwords for all affected accounts
Implemented multi-factor authentication for email access
Enhanced email security
Conducted additional employee training
Reviewing policies and procedures relating to data security
Offering one year of complimentary credit monitoring and identity restoration services through TransUnion Interactive
Changes made: Implemented multi-factor authentication for email access
Enhanced email security
Conducted additional employee training
Reviewing policies and procedures relating to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: CA 60-day late · 108d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 14, 2018
→ Notified: Dec 31, 2018
108d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 14, 2018 → Notified: Dec 31, 2018	108d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGDec 31 · first

Oregon State AGDec 31 · first

Montana State AGDec 31 · first

Washington State AGDec 31 · first

California State AG+2d · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-143451
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 2, 2019
Raw hash: b3c3b2cc313faa6b1a384bf2b2b998498edac482fc1113ccdd98f42e9024dcac

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAimbridge Hospitality Holdings, LLC

Victim entityAimbridge Hospitality Holdings, LLC

Incidentdiscovered Sep 14, 2018

Stated responseLaunched an investigation into the unusual activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov