HackingHospitalityHospitalityCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Interstate Management Company, LLC

bd_f3721a55df207f3f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2026

Filed

May 26, 2026

To disclose

—

Affected

1state residents only

Linked

7 filings

Confidence

66%

Full breach record for Interstate Management Company, LLC →

Interstate Management Company, LLC reported a data breach affecting hotel systems in Nebraska. Unauthorized access occurred between November 19-22, 2025, and was confirmed on April 23, 2026. One Nebraska resident's name and Social Security number were potentially accessed. The company notified law enforcement, provided one year of credit monitoring through IDX, and issued notices to regulators and credit bureaus.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 155 days

Nov 19, 2025

Begins

Apr 23, 2026

Discovered

May 26, 2026

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_604a38f9d0f903942026-05-26Verified
Massachusetts State AGbd_76511e81864b77022026-05-26Candidate
Maine State AGbd_c3abfae1f8e44f332026-05-26Verified
Indiana State AGbd_ccb9a19feee546fa2026-05-26Verified

Show 2 more filings ↓up to 2d gap

Vermont State AGbd_f15b1d2268e818fe2026-05-26Verified
Texas State AGbd_6b1874efb28835fc2026-05-28 · +2dVerified by operator

Name: Interstate Management Company, LLC
norm: interstate management

Name: Interstate Management Company, LLC
norm: interstate management
Industry: Hospitalityllm

Discovered: Apr 23, 2026
Breach occurred: Nov 19, 2025 – Nov 22, 2025
Undetected for: 155 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 26, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External
Regulator citations: providing written notice of this incident to relevant state regulators

During the incident: Took steps to secure systems
Investigate what happened
Identify the data that may be involved
Review of the information involved
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for one (1) year, through IDX
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators
Providing written notice... to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notified law enforcement
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGMay 26 · first

Massachusetts State AGMay 26 · first

Maine State AGMay 26 · first

Indiana State AGMay 26 · first

Vermont State AGMay 26 · first

Nebraska State AGMay 26 · first · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/b4c04595-a107-4bf6-937f-ff136f6ba887.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 26, 2026
Raw hash: 57948c66c169e2bfa240b1421743d647f273f31baec9fc248ab89c1624b25e2e

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityInterstate Management Company, LLC

Victim entityInterstate Management Company, LLC

Incidentdiscovered Apr 23, 2026

Stated responseTook steps to secure systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov