Social EngineeringHospitalityHospitalityPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIICredentialsIdentity (basic)LowContained

Aimbridge Hospitality Holdings, LLC

bd_f0163d88cb1b3a51 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 21, 2018

Filed

Jun 7, 2018

To disclose

11 weeks

Affected

527state residents only

Linked

4 filings

Confidence

66%

Full breach record for Aimbridge Hospitality Holdings, LLC →3 incidents on file

Aimbridge Hospitality Holdings, LLC notified individuals of a data breach where employee email accounts were accessed via unauthorized credentials, likely obtained through phishing. The incident was discovered on March 21, 2018. Affected individuals were offered 12 months of credit monitoring. The breach involved personal information accessible via compromised email accounts.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 78 days

Mar 21, 2018

Discovered

Jun 7, 2018

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_02ca0befb963f7642018-06-07Verified
New Hampshire State AGbd_9ead90e00c8066532018-06-07Verified
California State AGbd_ae241e6da3a9354b2018-06-07Verified

Name: Aimbridge Hospitality Holdings, LLC
norm: aimbridge hospitality

Name: Aimbridge Hospitality Holdings, LLC
norm: aimbridge hospitality
Industry: Hospitalityllm

Discovered: Mar 21, 2018
Materiality determined: —
Notification sent: Jun 4, 2018
Affected individuals: 527state-resident count only
Data types: PIICredentialsIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: providing notice to certain state regulators and the consumer reporting agencies
Initial access: phishing_link

During the incident: Changed the employee’s credentials
Launched an investigation, with the assistance of third-party forensic investigation firm
Offering you complimentary access to 12 months of credit monitoring and identity restoration services with TransUnion
Providing notice to certain state regulators and the consumer reporting agencies
Changes made: Reviewing our policies and procedures to better protect against an event like this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(78 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJun 7 · first

New Hampshire State AGJun 7 · first

California State AGJun 7 · first

Montana State AGJun 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Aimbridge-Hospitality-Holdings-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2018
Raw hash: 564a73a6aa42fb3c7d53f7a5a1a1d0f7a937d104d7b782cc2e154b7ae642d640

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAimbridge Hospitality Holdings, LLC

Victim entityAimbridge Hospitality Holdings, LLC

Incidentdiscovered Mar 21, 2018

Stated responseChanged the employee’s credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov