HILTON WORLDWIDE HOLDINGS INC.

Hilton Worldwide Holdings Inc. (Hilton) filed its 10-K Item 1C disclosing its cybersecurity governance and risk management framework. The filing states that as of the report date, Hilton is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. No specific incident, breach, or material impact is disclosed.

Hilton Worldwide, Inc., a business sector entity reported a malware incident to the Washington Attorney General. The organization became aware of the incident on 2015-02-10 and filed notice on 2015-11-24. 287 days elapsed between awareness and notification.

Hilton Worldwide disclosed a point-of-sale malware incident affecting payment card data at its hotels. The malware ran during two windows: November 18–December 5, 2014 and April 21–July 27, 2015. Cardholder names, payment card numbers, security codes, and expiration dates were targeted. No addresses or PINs were compromised. Hilton worked with third-party forensic experts, law enforcement, and payment card companies. One year of complimentary credit monitoring through AllClear was offered to affected customers.