Hilton Honors

Multiple separate breaches across a decade, including the shared Otelier vendor incident (2024 intrusion, disclosed January 2025) that also caught Hyatt and Marriott - three competing hotel groups exposed through one back-end platform none of their guests had heard of. Hotel data is distinctively revealing: a reservation record is a person's physical location on specific dates, often with a second guest name attached, plus payment details and loyalty history that maps travel patterns over years. Marriott's own record, documented elsewhere in this tracker, includes one of the longest-running undetected intrusions ever recorded.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

REPORTED TRACKING/COOKIE LAWSUIT (California; caption and current status not independently verified as of Oct 2026): reportedly alleges Hilton continued collecting website visitors' data even AFTER they explicitly opted out of cookies — plaintiffs argue this gave them a 'false sense of privacy,' having relied on Hilton's assurance that opting out would actually stop data collection.

Data sharing

MULTIPLE SEPARATE BREACHES ACROSS A DECADE: (1) Breaches in late 2014 and 2015 exposed more than 350,000 PAYMENT CARD NUMBERS (per the New York AG, as reported) — New York and Vermont investigators concluded Hilton 'did not provide a reasonable level of security'; Hilton did not disclose the breaches until November 24, 2015 (the PCI-DSS non-compliance finding and a nine-month notification delay were reported but not re-verified this pass). Hilton paid $700,000 to settle with New York and Vermont. (2) A January 2023 claimed breach: a hacker calling themselves 'IntelBroker' claimed to have stolen 3.7 MILLION Hilton Honors records (a 2017 database); Hilton said there was no evidence its systems had been compromised, and later said the offered reservation records, after de-duplication, related to approximately 500,000 Hilton Honors accounts — it did not acknowledge a breach of its own systems. (3) A SEPARATE breach at OTELIER (intrusion July-October 2024, disclosed January 2025), a third-party hotel-management PLATFORM used by 10,000+ hotels — attackers claimed to have used stolen credentials to reach Otelier's Amazon S3 storage and download about 7.8 TERABYTES (Marriott-related hotel reports, shift audits and accounting data, plus guest reservation records), with Hilton, Hyatt and Wyndham data also reported in the stolen set, illustrating the same shared-vendor exposure pattern documented for SITA in the Global Airlines tab.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (HLT). Service route: c/o General Counsel / Corporate Secretary, McLean, Virginia — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.