Cyber Incident Victim: Maine Course Hospitality Group
Timeline
Summary
Maine Course Hospitality Group discovered unauthorized access to its computer systems and later reported that the breach exposed personal data of over seven thousand individuals, including names, Social Security numbers and driver’s license numbers. The company said it offered affected individuals a year of complimentary credit monitoring and identity protection services. A class‑action lawsuit alleges the firm failed to adequately safeguard the information and delayed notification for about nine months, violating state breach‑notice requirements. The plaintiff seeks class status, damages and other relief on behalf of everyone whose data was compromised.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Maine Course Hospitality Group discovered unauthorized access to its computer systems in November 2025. The company determined that the breach affected 7,108 individuals, of whom 3,989 were residents of Maine. According to the data breach notice filed with the Maine Attorney General's Office last week, the compromised information may have included names, Social Security numbers, driver's license numbers and other personal data. The hospitality group owns and manages dozens of hotels across Maine, New England and New York, including the Courtyard by Marriott in Portland's Old Port. The notice stated that the company would provide one year of complimentary credit monitoring and identity protection services to affected individuals. The breach notice was submitted to state authorities after the discovery, as indicated by the filing last week.
A class-action lawsuit was filed in U.S. District Court in Maine this week, alleging that Maine Course Hospitality Group failed to adequately protect customers' sensitive personal information. The lawsuit contends that the company waited approximately nine months after discovering the cyberattack before notifying the affected individuals. This delay is said to violate Maine's data breach notification law, which requires notice without unreasonable delay and generally within thirty days of discovery. The plaintiff seeks class-action status on behalf of all persons whose information was compromised, as well as damages and other relief. In its breach notice, the company offered the credit monitoring and identity protection services mentioned earlier. The CBS13 I-Team attempted to obtain comment from the company regarding the lawsuit and the breach but received no response.