The California Office of the Attorney General disclosed a data breach affecting Kimpton Hotels & Restaurants, stemming from unauthorized access to Sabre Hospitality Solutions' system—a third-party reservation platform used by the company. The breach occurred over a prolonged period, from August 10, 2016, to March 9, 2017, but was only reported on July 28, 2017.During this window, threat actors gained access to sensitive customer data, including payment card information (e.g., credit/debit card numbers, expiration dates, and security codes) and personal details (such as names, addresses, and possibly other identifying information). The exposure primarily impacted guests who made reservations or transactions through Sabre’s system during the specified timeframe.While the exact number of affected individuals was not detailed in the report, the breach posed significant risks of financial fraud and identity theft for customers. Kimpton Hotels & Restaurants, as the affected entity, faced potential reputational damage and legal liabilities due to the failure to secure third-party vendor systems. The incident underscored vulnerabilities in supply chain cybersecurity, where breaches in partner systems can directly compromise a company’s customer data.

The Washington State Office of the Attorney General reported a data breach involving Kimpton Hotels & Restaurants on August 31, 2016. The breach, identified on July 15, 2016, involved a malware cyberattack affecting the payment card information of approximately 5,428 Washington residents, with the incident dating from February 16, 2016 to July 7, 2016.