MalwareHospitalityHospitalityRansomwareData ExfiltratedCustomer Data InvolvedPCIFinancial accountLowContained

Hyatt Centric The Loop

bd_e72d4deaa3cc69a2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 4, 2017

Filed

Aug 7, 2017

To disclose

3 days

Affected

8state residents only

Linked

3 filings

Confidence

66%

Full breach record for Hyatt Centric The Loop →

Hyatt Centric The Loop Chicago (operated by Integrated Clark Monroe, LLC) experienced a malware attack on its front desk system from September 27, 2016, to April 28, 2017. Malware captured guest payment card data (names, card numbers, CVVs, expiration dates). The hotel engaged law enforcement (Secret Service) and a third-party cybersecurity firm. Notification was sent to 8 New Hampshire residents on August 7, 2017, with nationwide substitute notification via website. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 311 days

discovery → filing · 3 days

Sep 27, 2016

Begins

Aug 4, 2017

Discovered

Aug 7, 2017

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_2f3c81fdbd09484a2017-08-07Candidate
Montana State AGbd_41166994aa3b2bbf2017-08-07Verified

Name: Integrated Clark Monroe, LLC
norm: integrated clark monroe

Name: Hyatt Centric The Loop
norm: hyatt centric the loop
Industry: Hospitalityllm

Discovered: Aug 4, 2017
Breach occurred: Sep 27, 2016 – Apr 28, 2017
Undetected for: 311 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 7, 2017
Affected individuals: 8state-resident count only
Data types: PCIFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: reported the incident to the U.S. Secret Service
Initial access: exploit_public_facing

During the incident: Contacted appropriate federal law enforcement officials
Initiated an internal review
Engaged a third-party cybersecurity firm that deployed monitoring software at the Hotel
Identified the malicious software and removed it from hotel systems
Took steps to upgrade security tools protecting the front desk system
Reported the incident to the U.S. Secret Service
Upgraded the security features of its computer system with software that is capable of identifying and deactivating the malware used in this attack
Sending notification letters to potentially affected individuals
Provided substitute notification nationwide via website posting
Providing... the option for each potentially affected guest to enroll in a credit monitoring protection program for one (1) year
Changes made: Upgraded security tools protecting the front desk system
Upgraded the security features of its computer system with software that is capable of identifying and deactivating the malware used in this attack
Providing... the option for each potentially affected guest to enroll in a credit monitoring protection program for one (1) year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 3 days(3 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGAug 7 · first

Montana State AGAug 7 · first

New Hampshire State AGAug 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hyatt-centric-20170807.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2017
Raw hash: 21220ec942d5e2b1861d77c6ea6375853931c512370afc1ccbecae5727fd3416

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityIntegrated Clark Monroe, LLC

Victim entityHyatt Centric The Loop

Incidentdiscovered Aug 4, 2017

Stated responseContacted appropriate federal law enforcement officials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov