Waterford Hotel Group data breach: systems viewed or downloaded, letters four months later

Date	Event
May 5, 2026	Waterford identifies suspicious activity on certain computer systems
September 25, 2026	Letters begin; reports to New Hampshire (383) and Massachusetts (2,612)
October 2, 2026	Hartford Business Journal reports the notice posted on Waterford's website

What happened at Waterford Hotel Group?

The company's counsel told New Hampshire that Waterford secured its systems, investigated, and found an unknown actor had gained access and could view or download data. Waterford then reviewed the data to work out what was in it and whose it was, and began notifying people when that review finished. The website notice adds that third-party forensic specialists helped with the investigation.

The Hartford Business Journal, which reported the notice, pointed out what it leaves out: when the access began, how the systems were compromised, whose data was involved, and how many people were affected. The state filings answer the last question in part: 2,995 people in two states.

Who is Waterford Hotel Group?

The Journal describes it as one of Connecticut's largest hotel owners and operators, with more than 6,200 hotel rooms in nine states. Its Connecticut hotels include the Sheraton Hartford Hotel at Bradley Airport, Hyatt House Windsor, Marriott Hartford Downtown and DoubleTree by Hilton Hartford Downtown. A guest at one of those hotels may get a letter from Waterford, a name they never booked with. The guide to letters from a company you never dealt with explains why management companies send these.

What information was exposed?

It depends on the filing. The New Hampshire notice lists name, driver's license number, Social Security number and payment card information. The website notice gives the full range across everyone: it adds passport number, taxpayer ID, financial account information, username and password, and medical and health insurance information. The notice does not say whether those records belong to guests or employees. Massachusetts marks Social Security numbers, financial accounts, driver's licenses and card numbers, but not medical records.

Record	Residents	Data it marks
Massachusetts OCABR, report 2026-1636	2,612	Social Security numbers, financial accounts, driver's licenses, card numbers
New Hampshire DOJ notice, September 25, 2026	383	Name, driver's license, Social Security number, payment card
Two states	2,995

What is Waterford offering?

The terms differ by state. The New Hampshire notice says Waterford offers twelve months of credit monitoring through TransUnion. The Massachusetts letter offers single-bureau credit monitoring with alerts for twenty-four months, provided by Cyberscout, a TransUnion company. Enrollment is at bfs.cyberscout.com/activate with the code in the letter. Questions go to 1-888-940-9724 or to 914 Hartford Turnpike, P.O. Box 715, Waterford, CT 06385. Anyone whose card number is listed should check card statements and ask the bank for a new card. For how these offers compare, see the credit monitoring guide.

What the documents leave open

• When the unknown actor first got in, and how.
• Whether the people affected are guests, employees or both.
• The total across all nine states; only New Hampshire and Massachusetts counts were found.