Student Loans, Hotels & Auto · Hotel · Data breach
Hyatt
Headline
Same 2025 Otelier vendor breach as Hilton and Marriott - recorded as one connected finding rather than three, per this tracker's cross-reference standard.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Same 2025 Otelier vendor breach as Hilton and Marriott - recorded as one connected finding rather than three, per this tracker's cross-reference standard. The point for a traveller is that hotel loyalty programmes actively encourage consolidating stays with one brand, which is presented as a benefit and functions as data concentration: the more loyal you are, the more complete the movement history held by a single company and by whichever vendors it uses. Choosing a different chain would not have helped here, since the exposure was at the shared vendor.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
SAME SHARED 2025 OTELIER VENDOR BREACH as Hilton and Marriott (see Hilton row for full detail) — Hyatt is among the brands named in reporting on the breach of Otelier, a hotel data-management platform used by more than 10,000 hotels, whose Amazon S3 storage was accessed (intrusion reportedly July-Oct 2024, disclosed January 2025), exposing guest contact and reservation data as well as hotel operational data across multiple major brands; Hyatt did not comment publicly. SEPARATE, HISTORICAL BREACHES: Hyatt's 2015 payment-card hack affected about 250 locations (per Wikipedia's list of data breaches); a further 2017 payment-card incident affecting properties internationally has been reported but was not re-verified this pass — part of the same broader wave of hospitality-industry point-of-sale breaches that also hit Hilton, IHG, Trump Hotels, and Omni Hotels around the same period.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy hyatt.com/info/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service hyatt.com/en-US/info/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.