Westin San Diego Bayview data breach: hotel systems accessed over four days in November 2025

Date	Event
November 19 to 22, 2025	Unauthorized access to certain systems at The Westin San Diego Bayview
April 23, 2026	Interstate Management confirms personal information may have been accessed or taken
May 26, 2026	Letters; notice to New Hampshire (10 residents) and Massachusetts (633)
August 26, 2026	Enrollment deadline for the IDX monitoring offered

What happened at The Westin San Diego Bayview?

The notice is about one hotel. Counsel for Interstate Management wrote to New Hampshire about an incident at The Westin San Diego Bayview. The letter itself says Interstate Management operates the hotel. It describes access to "certain hotel systems" over four days in November 2025 and a review of the files involved. It does not say which systems, how the intruder got in, or whether ransomware was involved.

The letters were sent about six months after the access, and 33 days after Interstate Management confirmed personal information was involved. The notice letter delay guide compares gaps like this one.

Who got a letter about The Westin San Diego Bayview?

The letter does not say whether those notified are guests, employees or both. Massachusetts marks medical records as well as Social Security numbers and card numbers. The filed letter leaves the data list as a template field after "name", so the categories for each person are on the letter as mailed. The guide to letters from a company you never dealt with explains why a letter can come from a hotel operator rather than the brand on the building.

What information was exposed?

Name, Social Security number and payment card information, according to the notice to New Hampshire.

Record	People	Data it marks
Massachusetts OCABR, report 2026-843 (May 26, 2026)	633	SSNs, medical records, financial accounts, card numbers
New Hampshire DOJ notice (May 26, 2026)	10	Name, SSN, payment card information

For other payment card cases, see the payment card breach notice guide.

What is Interstate Management offering?

Credit monitoring through IDX at no cost. The notice to New Hampshire says one year. The sample letter shows 12 or 24 months as a template choice and an enrollment deadline of August 26, 2026, which has passed. The company says it is adding safeguards and staff training, and that it notified law enforcement. The credit monitoring guide compares offers.

What the documents leave open

• Which hotel systems were accessed, and how.
• Whether guests, employees or both were notified, and the total across all states.
• Why the confirmation came five months after the access.