Nature of the Data Event

Similar documents
James E. Prendergast 1275 Drummers Lane, Suite 302 Office: Wayne, PA Fax:

Sian M. Schafle 1275 Drummers Lane, Suite 302 Office: Wayne, PA Fax:

Paul T. McGurkin, Jr Drummers Lane, Suite 302 Office: Wayne, PA Fax:

October 30, 2017 File No VIA ELECTRONIC SUBMISSION

L EW) S BRISBOIS BISGAARD. & SMITH LLP Fax: ATTORNEYS AT Law www, lewisbrisbols.com

Nature of the Data Security Incident ALBUQUERQUE ATLANTA BEAUMONT BOSTON CHARLESTON CHICAGO DALLAS DENVER FORT LAUDERDALE HOUSTON LAQUINTA

September 29, 2017 VIA AND OVERNIGHT MAIL

Kris Kleiner Via to: March 2, 2018

Noble House Hotels & Resorts Notifies Guests of Payment Card Security Incident

3. Steps you have taken or plan to take relating to the incident.

We are writing to notify you of an incident on behalf of our client, Title Nine Sports, Inc. ( Title Nine ).

August 18, Re: Security Incident Notice. Dear Attorney General Ferguson:

fiu.n1 OI j& WllJ JAMS

May 15, VIA

July 6, Data Security Incident. Dear Assistant Attorney General Ferguson:

Edward J. Finn 1275 Drummers Lane, Suite 302 Office: Wayne, PA Fax:

NOTICE OF DATA BREACH

Notice to Patients and Job Applicants Regarding Vendor Security Incident

ATG MI ADM Security Breach

MICHIGAN STATE UNIVERSITY

945 East Paces Ferry Rd., Suite 1475, Atlanta, GA aptos.com

April 27, Dear John Sample:

RE \\I. NO'V o s 2ms. CONSUMER PROlECl\ON

July 21, Data Security Incident. Dear Attorney General Ferguson:

~41ILIJ1\}dS NEW YORK, NY

August 12, 2016 VIA AND OVERNIGHT MAIL

9NFP. Return Mail Processing Center PO Box 6336 Portland, OR

Huwro N&: \VIIJ.1.A}vi TEL April 18, 2016 FILENO

BakerHostetler APR April 26, 2016 VIA OVERNIGHT DELIVERY

May 11, Via Office of the Attorney General 1125 Washington Street SE P.O. Box Olympia, WA

August 31, 2016 VIA AND OVERNIGHT MAIL

Katten. July 14, Via Electronic Mail Only

McDonald Hop kins. January 23, Office of Washington Attorney General Consumer Protection Division 800 5th Ave, Suite 2000 Seattle, WA

Citrus Valley Health Partners notifies patients of data security incident

Office of Privacy Protection Safeguarding Information for Your Future

Credit Freeze Instructions for Minors

Placing a Security Freeze on Your Credit Report

How to Freeze Your Credit Files Tips for Consumers

Sorry to hear your Equifax information was likely compromised. The key to keeping safe now is:

Notification of Rights for Texas Consumers

Identity Theft Packet

IDENTITY THEFT PACKET

Here is some more information on the Equifax Breach and how you may protect yourself in the aftermath...

945 East Paces Ferry Rd., Suite 1475, Atlanta, GA aptos.com

Identity theft can occur even if you have been careful about protecting your personal information.

Equifax Phone: Address: Office of Fraud Assistance P.O. Box Atlanta, GA Internet:

IMPORTANT TAX INFORMATION

Links are provided on to provide you with the information you need if you wish to obtain the following.

Instructions for Completing the ID Theft Affidavit

Resources for Victims of IDENTITY THEFT. HENNEPIN COUNTY CHIEFS OF POLICE and HENNEPIN COUNTY ATTORNEY S OFFICE

To file a complaint please contact Moneydart Global Services Inc. Call Centre at before contacting your jurisdiction with a complaint.

How to Freeze Your Credit Files

Recourse for Employees Misclassified as Independent Contractors Department for Professional Employees, AFL-CIO

Union Members in New York and New Jersey 2018

! Required " Optional " Alterations Acceptable

September 15, SENT VIA: & First Class Mail

Take Charge: Fighting Back Against Identity Theft 37

American Memorial Contract

Identity Theft What to do if your identity is stolen

The Attorney General s Office established the Identity Theft Unit in response to increased identity theft incidents reported by Indiana citizens and

Get back your good name. Refuse to be a target of identity crime again.

Kentucky , ,349 55,446 95,337 91,006 2,427 1, ,349, ,306,236 5,176,360 2,867,000 1,462

ACORD Forms Updated in AMS R1

Huntington Director Outlook Series I/IR. Talcott Resolution Life Insurance Company Separate Account Two. File No

Instructions for Completing the ID Theft Affidavit

State Postal Abbreviation Codes

Undocumented Immigrants are:

Income from U.S. Government Obligations

Checkpoint Payroll Sources All Payroll Sources

Ability-to-Repay Statutes

Identity Theft Victim s Packet

36 Million Without Health Insurance in 2014; Decreases in Uninsurance Between 2013 and 2014 Varied by State

)TADA. 4 Texas Automobile Dealers Association. TADA Members. To: From: Date: Karen Phillips May Re: MEMORANDUM

NAU Police Department s Identity Theft Victim s Packet

STATE TAX WITHHOLDING GUIDELINES

Termination Final Pay Requirements

Aetna Individual Direct Pay Commissions Schedule

Helping Victims of Identity Theft and Consumer Fraud Crimes., 2017 at 3 pm ET Thursday, July 13, 2017 at 3:00pm ET

medicaid a n d t h e How will the Medicaid Expansion for Adults Impact Eligibility and Coverage? Key Findings in Brief

The Effect of the Federal Cigarette Tax Increase on State Revenue

Identity Theft Victim s Packet

State Individual Income Taxes: Personal Exemptions/Credits, 2011

State Resources for Employees Misclassified as Independent Contractors Department for Professional Employees, AFL CIO December 2015

TA X FACTS NORTHERN FUNDS 2O17

Pay Frequency and Final Pay Provisions

How to Dispute Credit Report Errors

Talcott Resolution Life Insurance Company or Talcott Resolution Life and Annuity Insurance Company

MEDICAID BUY-IN PROGRAMS

State Estate Taxes BECAUSE YOU ASKED ADVANCED MARKETS

ALABAMA BILL OF RIGHTS

2012 RUN Powered by ADP Tax Changes

Fingerprint and Biographical Affidavit Requirements

JH Insurance Licensing Guide

Identity Theft Handbook Steps to Protect Yourself What to Do If You Are a Victim Policies to Reduce Identity Theft. MaryPIRG Foundation

Eaton Vance Open-End Funds

Monthly Complaint Report

Non-Financial Change Form

Residual Income Requirements

Do you allow for a revoked business to be listed as a manager or managing member?

Federal Registry. NMLS Federal Registry Quarterly Report Quarter I

Transcription:

v. LEWIS BRISBOIS 550 E. Swedesford Road, Suite 270 Wayne, Pennsylvania 19087 Telephone: 215.977.4100 BISGAARD & SMITH Up Fax: 215.977.4101 ATTORNEYS AT LAW www,lewisbrisbois.com RECEIVED `16 JM 20 A8 :06 ATTOR.NEY CEIQERAL STATE OF'=, il~'c1 GSE i1-lyf PIA JAMES E. PRENDERGAST June 10, 2016 DIRECT DIAL: 215.977.4058 JIM. PRENDERGAST@LEWISBRISBOIS.COM Office of the Attorney General 1125 Washington Street SE PO Box 40100 Olympia, WA 98504-0100 Re: Notice of Data Event Dear Sir or Madam: We represent MEI-GSR, 9550 Firestone Blvd. Suite #105, Downey, CA 90241. MEI-GSR is the owner of the Grand Sierra Resort, and we are writing to notify your office of an incident that may affect the security of personal information relating to certain Washington residents. The investigation into this event is ongoing, and this notice will be supplemented with any new significant facts learned subsequent to its submission. By providing this notice, MEI-GSR does not waive any rights or defenses regarding the applicability of Washington law or personal jurisdiction. Nature of the Data Event On or around September 29, 2015, the Grand Sierra Resort was contacted by law enforcement regarding an investigation into a potential compromise of payment card information used at food and retail locations at the Grand Sierra Resort. The Grand Sierra Resort immediately began to cooperate with law enforcement and to investigate this matter. Third party forensics investigators were retained to assist the Grand Sierra Resort. Since discovering the compromise, the Grand Sierra Resort has worked closely with law enforcement and its forensics investigators to determine what happened, what information may be at risk and to whom this information may relate. On or around January 11, 2016, these investigators confirmed that certain guest payment card information for cards used at food and retail locations at the Grand Sierra Resort may have been compromised. The investigation has determined that payment card information used at the Grand Sierra's onsite food and retail locations between February 19, 2014 and March 13, 2014 or March 20, 2015 and August 6, 2015 could be at risk. This includes information like the ARIZONA CALIFORNIA COLORADO CONNECTICUT FLORIDA GEORGIA ILLINOIS INDIANA KANSAS KENTUCKY LOUISIANA MARYLAND MASSACHUSETTS MISSOURI NEVADA NEW JERSEY NEW MEXICO NEWYORK NORTH CAROLINA OHIO.OREGON PENNSYLVANIA RHODE ISLAND TEXAS WASHINGTON WESTVIRGINIA 4825-1644-6514.1

June 10, 2016 Page 2 cardholder's name, credit card number, credit card expiration date, Track 1 data and Track 2 data. Please note that this incident did not affect payment cards used to book or pay for lodging. Notice to Washington Residents On April 25, 2016, the Grand Sierra Resort provided substitute notice of this incident to potentially affected customers by posting a notice to its website and issuing a press release to state wide media. Substitute notice was provided substantially the same form as the release attached here as Exhibit A. The Grand Sierra Resort was able to work with American Express and use its own records to identify the mailing addresses for some of the potentially impacted customers, which included one thousand sixty one (1061) Washington residents. This process took some time and the Grand Sierra Resort was able to being providing written notice to those customers the Grand Sierra Resort was able to find address information beginning on June 6, 2016. Written notice was provided in substantially the same form as the letter attached here as Exhibit B. Other Steps Taken and To Be Taken Upon being contacted by law enforcement, the Grand Sierra began to investigate and to prevent further unauthorized access to customer payment information. The Grand Sierra Resort has enhanced existing security measures to prevent further unauthorized access to customer payment information. The Grand Sierra Resort is providing potentially impacted customers with guidance on how to protect against identity theft and fraud, including information on how to place a fraud alert and security freeze on one's credit file, the contact details for the national consumer reporting agencies, how to obtain a free credit report, a reminder to remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring free credit reports, and encouragement to contact the Federal Trade Commission, state attorney general, and law enforcement to report attempted or actual identity theft and fraud. The Grand Sierra Resort has established a dedicated hotline for potentially affected individuals to contact with questions or concerns regarding this incident. The Grand Sierra Resort is also providing written notice of this incident to other state regulators and the national consumer reporting agencies as necessary. LEWIS BRISBOIS BISGAARD & SMITH LLP www.iewisbrisbois.com 4825-1644-6514.1

June 10, 2016 Page 3 Contact Information Should you have any questions regarding this notification or other aspects of the data security event, please contact us at 215-977-4058. Very truly yours, JEP CC: Office of the Attorney General Consumer Protection Division 8005 th Ave., Suite 2000 Seattle, WA 98104-3188 MES E. PRENDERGAST of LEWIS BRISBOIS BISGAARD & SMITH LLP LEWIS BRISBOIS BISGAARD & SMITH LLP www.lewisbrisbols.com 4825-1644-6514.1

Exhibit A

F April 25, 2016 RE: NOTICE OF DATA BREACH We are writing to notify guests of an unfortunate situation regarding a data security incident that may have affected the security of certain guest payment card information. Below is information on the incident and resources available to protect potentially impacted guests against identity theft or fraud, should they feel the need to do so. WHAT HAPPENED? On or around September 29, 2015, the Grand Sierra Resort was contacted by law enforcement regarding an investigation into a potential compromise of payment card information used at food and retail locations at the Grand Sierra Resort. We immediately began to cooperate with law enforcement and to investigate this matter. Third party forensics investigators were retained to assist the Grand Sierra Resort. On or around January 11, 2016, these investigators confirmed that certain guest payment card information for cards used at food and retail locations at the Grand Sierra Resort may have been compromised. WHAT INFORMATION WAS INVOLVED? The investigation has determined that payment card information used at the Grand Sierra's onsite food and retail locations between February 19, 2014 and March 13, 2014 or March 20, 2015 and August 6, 2015 could be at risk. This includes information like the cardholder's name, credit card number, credit card expiration date, Track 1 data and Track 2 data. Please note that this incident did not affect payment cards used to book or pay for lodging. WHAT WE ARE DOING? Since discovering the compromise, we have worked closely with law enforcement and our forensics investigators to determine what happened, what information may be at risk and to whom this information may relate. Additionally, as part of our ongoing commitment to the security of the personal information in our care, we have worked diligently to enhance existing security measures to prevent further unauthorized access to guest payment card information. WHAT YOU CAN DO. We encourage potentially impacted guests to review the information below on how to better protect against identity theft or fraud. FOR MORE INFORMATION. We apologize for any inconvenience and concern this incident causes you. The security of our guests' personal information is one of our highest priorities. Should you have any questions about the content of this notice or ways you can protect yourself from the possibility of identity theft, please call our dedicated hotline at (877) 216-3789 between 9 a.m. and 7 p.m. EST, Monday to Friday. Please use reference number 6216041816 when calling. ADDITIONAL STEPS YOU CAN TAKE TO PREVENT IDENTITY THEFT AND FRAUD You may take action directly to further protect against possible identity theft or other financial loss. We encourage you to be vigilant against incidents of identity theft by reviewing your account statements regularly and monitoring your credit reports for suspicious activity. Under U.S. law, you are entitled to one free credit report annually from each of the three major credit bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report. LIVEGRANE) 2500 East Second Street Reno Nevada 89595 www,grandsierraresort.com 775.789.20001800.648.5080

At no charge, you can also have these credit bureaus place a "fraud alert" on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any one of the agencies listed below. Equifax Experian TransUnion P.O. Box 105069 P.O. Box 2002 P.O. Box 2000 Atlanta, GA 30348 Allen, TX 75013 Chester, PA 19022-2000 800-525-6285 888-397-3742 800-680-7289 www.equifax.com www.experian.com www.transunion.com In addition to a fraud alert, consumers may place a security freeze on their credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a consumer's credit report without the consumer's written authorization. However, please be advised that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a credit reporting agency may charge you a fee to place, temporarily lift, or permanently remove a security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed above if you wish to place the freeze on all of your credit files. To find out more on how to place a security freeze, you can contact the credit reporting agencies using the information below: Equifax Security Freeze P.O. Box 105788 Atlanta, GA 30348 800-685-1111 800-349-9960 (NY Residents) www.freeze.equifax.com Experian Security Freeze P.O. Box 9554 Allen, TX 75013 888-397-3742 www.experian.com TransUnion LLC P.O. Box 2000 Chester PA 19022-2000 888-909-8872 freeze.transunion.com You can further educate yourself regarding identity theft, fraud alerts, and the steps you can take to protect yourself, by contacting the Federal Trade Commission or your state Attorney General, For North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202, 1-888-743-0023, www.oag.state.md.us. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, www.ftc.gov/idtheft/, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261, The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. Instances of known or suspected identity theft should also be reported to law enforcement. www.grands!erraresort.com 2500 East Second Street Reno. Nevada 89595 775.789.2000 1 800.648.5080

ngsrgrand SIERRA RESORT AND CASINO Return Mail Processing P.O. Box 190 Claysburg, PA 16625-0190 June 10, 2016 ##B8880-LO1-0123456 000100000001 **************9.OELZZ 123 SAMPLE A SAMPLE APT ABC 123 ANY ST ANYTOWN, US 12345-6789 "~III~IIIIJII~II'~~II'~'ll~~llll~~~~I'lll~~~ll~l~l'lll~i~~l~'~I RE: NOTICE OF DATA BREACH Dear Sample A Sample, We are writing to notify you of an unfortunate situation regarding a data security incident that may have affected the security of certain guest payment card information. We are writing to provide you with information on the incident and resources available to protect against identity theft or fraud, should you feel the need to do so. WHAT HAPPENED? On or around September 29, 2015, the Grand Sierra Resort was contacted by law enforcement regarding an investigation into a potential compromise of payment card information used at food and retail locations at the Grand Sierra Resort. We immediately began to cooperate with law enforcement and to investigate this matter. Third party forensics investigators were retained to assist the Grand Sierra Resort. On or around January 11, 2016, these investigators confirmed that certain guest payment card information for cards used at food and retail locations at the Grand Sierra Resort may have been compromised. WHAT INFORMATION WAS INVOLVED? The investigation has determined that payment card information used at the Grand Sierra's onsite food and retail locations between February 19, 2014 and March 13, 2014 or March 20, 2015 and August 6, 2015 could be at risk. This includes information like the cardholder's name, credit card number, credit card expiration date, Track 1 data and Track 2 data. Please note that this incident did not affect payment cards used to book or pay for lodging. WHAT WE ARE DOING. Since discovering the compromise, we have worked closely with law enforcement and our forensics investigators to determine what happened, what information may be at risk and to whom this information may relate. Additionally, as part of our ongoing commitment to the security of the personal information in our care, we have worked diligently to enhance existing security measures to prevent further unauthorized access to guest payment card information. WHAT YOU CAN DO. We encourage you to review the enclosed information on how to better protect against identity theft or fraud. FOR MORE INFORMATION. We apologize for any inconvenience and concern this incident causes you. The 0123458 security of your personal information is one of our highest priorities. Should you have any questions about the content of this letter or ways you can protect yourself from the possibility of identity theft, please call our dedicated hotline at (877) 216-3789 between 9 a.m. and 7 p.m. EST, Monday to Friday. Please use reference number 4843041816 when calling. Sincerely, Rod Luck, Sr. VP of Information Technology e88sa1-01

You may take action directly to further protect against possible identity theft or other financial loss. We encourage you to be vigilant against incidents of identity theft by reviewing your account statements regularly and monitoring your credit reports for suspicious activity. Under U.S. law, you are entitled to one free credit report annually from each of the three major credit bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report. At no charge, you can also have these credit bureaus place a "fraud alert" on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any one of the agencies listed below. Equifax Experian TransUnion P.O. Box 105069 P.O. Box 2002 P.O. Box 2000 Atlanta, GA 30348 Allen, TX 75013 Chester, PA 19022-2000 800-525-6285 888-397-3742 800-680-7289 www,equifax.com www.cxperian.com www.transunion.com In addition to a fraud alert, consumers may place a security freeze on their credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a consumer's credit report without the consumer's written authorization. However, please be advised that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a credit reporting agency may charge you a fee to place, temporarily lift, or permanently remove a security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed above if you wish to place the freeze on all of your credit files. To find out more on how to place a security freeze, you can contact the credit reporting agencies using the information below: Equifax Security Freeze P.O. Box 105788 Atlanta, GA 30348 800-685-1111 800-349-9960 (NY Residen,. Experian Security Freeze P.O. Box 9554 Allen, TX 75013 888-397-3742 WANIMAM 6TWIMPOW TransUnion LLC P.O. Box 2000 Chester, PA 19022-2000 888-909-8872 freeze.transunion.com You can further educate yourself regarding identity theft, fraud alerts, and the steps you can take to protect yourself, by contacting the Federal Trade Commission or your state Attorney General. For North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 16' Floor, Baltimore, MD 21202, 1-888-743-0023, www.oag.state.md.us. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, www.ftc.gov/idtheft/, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. Instances of known or suspected identity theft should also be reported to law enforcement. 68880 L01

rgs)rgrand SIERRA RESORT AND CASINO Return Mail Processing P.O. Box 190 Claysburg, PA 16625-0190 June 10, 2016 ##B8880-LO1-0123456 000100000001 **************9-OELZZ 123 TO THE ESTATE OF SAMPLE A SAMPLE APT ABC 123 ANY ST ANYTOWN, US 12345-6789 "~II LIIII~III~II~~+II~~JI~il~ll~~~~lilllnill~lil'lll~l~~l~'~I RE: NOTICE OF DATA BREACH To the Estate of Sample A Sample, We are writing to notify you of an unfortunate situation regarding a data security incident that may have affected the security of certain guest payment card information. We are writing to provide you with information on the incident and resources available to protect against identity theft or fraud, should you feel the need to do so. WHAT HAPPENED? On or around September 29, 2015, the Grand Sierra Resort was contacted by law enforcement regarding an investigation into a potential compromise of payment card information used at food and retail locations at the Grand Sierra Resort. We immediately began to cooperate with law enforcement and to investigate this matter. Third party forensics investigators were retained to assist the Grand Sierra Resort. On or around January 11, 2016, these investigators confirmed that certain guest payment card information for cards used at food and retail locations at the Grand Sierra Resort may have been compromised. WHAT INFORMATION WAS INVOLVED? The investigation has determined that payment card information used at the Grand Sierra's onsite food and retail locations between February 19, 2014 and March 13, 2014 or March 20, 2015 and August 6, 2015 could be at risk. This includes information like the cardholder's name, credit card number, credit card expiration date, Track 1 data and Track 2 data. Please note that this incident did not affect payment cards used to book or pay for lodging. WHAT WE ARE DOING. Since discovering the compromise, we have worked closely with law enforcement and our forensics investigators to determine what happened, what information may be at risk and to whom this information may relate. Additionally, as part of our ongoing commitment to the security of the personal information in our care, we have worked diligently to enhance existing security measures to prevent further unauthorized access to guest payment card information. WHAT YOU CAN DO. We encourage you to review the enclosed information on how to better protect against identity theft or fraud. FOR MORE INFORMATION. We apologize for any inconvenience and concern this incident causes you. The 012- security of your personal information is one of our highest priorities. Should you have any questions about the,k~, content of this letter or ways you can protect yourself from the possibility of identity theft, please call our j dedicated hotline at (877) 216-3789 between 9 a.m, and 7 p.m. EST, Monday to Friday. Please use reference number 4843041816 when calling. Sincerely, Rod Luck, Sr. VP of Information Technology BW80.1-01

You may take action directly to further protect against possible identity theft or other financial loss. We encourage you to be vigilant against incidents of identity theft by reviewing your account statements regularly and monitoring your credit reports for suspicious activity. Under U.S, law, you are entitled to one free credit report annually from each of the three major credit bureaus. To order your free credit report, visit www.annualercditrcport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report. At no charge, you can also have these credit bureaus place a "fraud alert" on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any one of the agencies listed below. Equifax Experian TransUnion P.O. Box 105069 P.O. Box 2002 P.O. Box 2000 Atlanta, GA 30348 Allen, TX 75013 Chester, PA 19022-2000 800-525-6285 888-397-3742 800-680-7289 www.equifax.com www.experian.com www.transunion.com In addition to a fraud alert, consumers may place a security freeze on their credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a consumer's credit report without the consumer's written authorization. However, please be advised that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a credit reporting agency may charge you a fee to place, temporarily lift, or permanently remove a security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed above if you wish to place the freeze on all of your credit files. To find out more on how to place a security freeze, you can contact the credit reporting agencies using the information below: Equifax Security Freeze P.O. Box 105788 Atlanta, GA 30348 800-685-1111 800-349-9960 (NY Residents) www.freeze.equifax.com Experian Security Freeze P.O. Box 9554 Allen, TX 75013 888-397-3742 AA - - - TransUnion LLC P.O. Box 2000 Chester, PA 19022-2000 888-909-8872 freeze.transunion.com You can further educate yourself regarding identity theft, fraud alerts, and the steps you can take to protect yourself, by contacting the Federal Trade Commission or your state Attorney General. For North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6400, www.nedoj.gov, For Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 101 Floor, Baltimore, MD 21202, 1-888-743-0023, www.oag.state.md.us. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, www.ftc.gov/idtheft/, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. Instances of known or suspected identity theft should also be reported to law enforcement. 88880-L01

ngsrgrand SIERRA RESORT AND CASINO Return Mail Processing P.O. Box 190 Claysburg, PA 16625-0190 June 10, 2016 ##B8880-LO1-0123456 SAMPLE A SAMPLE APT ABC 123 ANY ST ANYTOWN, REG 12345-6789 COUNTRY RE: NOTICE OF DATA BREACH Dear Sample A Sample, We are writing to notify you of an unfortunate situation regarding a data security incident that may have affected the security of certain guest payment card information. We are writing to provide you with information on the incident and resources available to protect against identity theft or fraud, should you feel the need to do so. WHAT HAPPENED? On or around September 29, 2015, the Grand Sierra Resort was contacted by law enforcement regarding an investigation into a potential compromise of payment card information used at food and retail locations at the Grand Sierra Resort. We immediately began to cooperate with law enforcement and to investigate this matter. Third party forensics investigators were retained to assist the Grand Sierra Resort. On or around January 11, 2016, these investigators confirmed that certain guest payment card information for cards used at food and retail locations at the Grand Sierra Resort may have been compromised. WHAT INFORMATION WAS INVOLVED? The investigation has determined that payment card information used at the Grand Sierra's onsite food and retail locations between February 19, 2014 and March 13, 2014 or March 20, 2015 and August 6, 2015 could be at risk. This includes information like the cardholder's name, credit card number, credit card expiration date, Track 1 data and Track 2 data. Please note that this incident did not affect payment cards used to book or pay for lodging. WHAT WE ARE DOING. Since discovering the compromise, we have worked closely with law enforcement and our forensics investigators to determine what happened, what information may be at risk and to whom this information may relate. Additionally, as part of our ongoing commitment to the security of the personal information in our care, we have worked diligently to enhance existing security measures to prevent further unauthorized access to guest payment card information. WHAT YOU CAN DO. We encourage you to review the enclosed information on how to better protect against identity theft or fraud. FOR MORE INFORMATION. We apologize for any inconvenience and concern this incident causes you. The 012345, security of your personal information is one of our highest priorities. Should you have any questions about the ' ~ content of this letter or ways you can protect yourself from the possibility of identity theft, please call our dedicated hotline at (877) 216-3789 between 9 a.m, and 7 p.m. EST, Monday to Friday. Please use reference number 4843041816 when calling. Sincerely, Rod Luck, Sr. VP of Information Technology I38aaaL01

You may take action directly to further protect against possible identity theft or other financial loss. We encourage you to be vigilant against incidents of identity theft by reviewing your account statements regularly and monitoring your credit reports for suspicious activity. Under U.S, law, you are entitled to one free credit report annually from each of the three major credit bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report. At no charge, you can also have these credit bureaus place a "fraud alert" on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any one of the agencies listed below. Equifax Experian TransUnion P.O. Box 105069 P.O. Box 2002 P.O. Box 2000 Atlanta, GA 30348 Allen, TX 75013 Chester, PA 19022-2000 800-525-6285 888-397-3742 800-680-7289 www.equifax.com www.experian.com www.transunion.com In addition to a fraud alert, consumers may place a security freeze on their credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a consumer's credit report without the consumer's written authorization, However, please be advised that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a credit reporting agency may charge you a fee to place, temporarily lift, or permanently remove a security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed above if you wish to place the freeze on all of your credit files. To find out more on how to place a security freeze, you can contact the credit reporting agencies using the information below: Equifax Security Freeze P.O. Box 105788 Atlanta, GA 30348 800-685-1111 800-349-9960 (NY Residen Experian Security Freeze P.O. Box 9554 Allen, TX 75013 888-397-3742 MAIA - Ir TransUnion LLC P.O. Box 2000 Chester, PA 19022-2000 888-909-8872 freeze.transunion.com You can further educate yourself regarding identity theft, fraud alerts, and the steps you can take to protect yourself, by contacting the Federal Trade Commission or your state Attorney General, For North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 1611 Floor, Baltimore, MD 21202, 1-888-743-0023, www.oag.state.md.us. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, www.ftc.goy/idtheft/, 1-877-tD-THEFT (1-877-438-4338); TTY: 1-866-653-4261, The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. Instances of known or suspected identity theft should also be reported to law enforcement. BM80 L01