Choice Hotels breach exposes Social Security numbers and other personal data

One of the world's largest lodging franchisors, Choice Hotels International, has disclosed a data breach involving sensitive data belonging to franchisees and franchise applicants.

In a data breach notice, Choice explained that a threat actor used social engineering to access an application containing records related to franchisees and franchise applicants on January 14th, 2026.

The company says that the breach occurred even though access required multifactor authentication.

Upon detecting the unauthorized activity, Choice shut down access in less than an hour and immediately conducted an investigation to assess the scope of the attack. By January 26th, the company said it had identified and thoroughly reviewed the accessed records and determined that they included personal information such as names and Social Security numbers.

The breach appears to be limited to franchisees and franchise applicants and not involve hotel guests, although the exact number of victims was not mentioned in the filings. Disclosures show that the breach affected 66 Maine residents and 67 New Hampshire residents, while the attorneys general of California and Vermont were also informed.

The company is now offering two years of credit monitoring via Epiq Privacy Solutions ID, which includes three-bureau credit monitoring through Equifax, credit report and score access, $1 million identity theft insurance with $0 deductible, ID Restoration services, and dark web monitoring.

Affected individuals are warned to stay alert for instances of fraud and identity theft and review their account statements and free credit reports for any unauthorized activity.

In July 2023, Radisson Hotels Americas, acquired by Choice Hotels, was compromised as part of the massive MOVEit file transfer system hack carried out by the Cl0p ransomware gang.