Notice of Data Security Incident

M&R Hospitality Management (“M&R”) is notifying individuals whose personal information may have been involved in a recent data security incident. M&R is a hotel management company located in New York.

On or about April 15, 2024, M&R detected and stopped suspicious activity within its business email environment. Upon detecting the incident, M&R moved quickly to secure its email environment and launched a thorough investigation. The investigation was performed with the help of independent IT security and forensic investigators to determine the scope and extent of the data security incident.

As a result of the incident, M&R determined the following information was exposed to an unauthorized third party: first and last name, date of birth, driver’s license number, passport, USCIS number, financial account number, payment card number, payment card access number, personal health information and/or Social Security number. Notably, the types of information affected were different for each individual, and not every individual had any or all of the elements listed above exposed.  As of this writing, M&R has not received any reports of related identity theft since the date of the incident (April 15, 2024 to present).

Although M&R found no evidence any individual information has been specifically accessed for misuse, M&R is mailing letters to potentially impacted individuals with details about the incident and providing resources they can use to help protect their information. M&R is also offering potentially involved individuals access to free credit monitoring and identity theft protection services through Cyberscout, a TransUnion company leading in identity protection.

The notification letter to the potentially impacted individuals includes steps they can take to protect their information. In order to address any concerns and mitigate any exposure or risk of harm following this incident, M&R has arranged for complimentary credit monitoring services and identity theft protection services to all potentially impacted individuals at no cost to them. M&R recommends individuals enroll in the services provided and follow the recommendations contained within the notification letter to ensure their information is protected.

Individuals should refer to the notice they receive in the mail regarding steps they can take to protect themselves. As a precautionary measure, potentially impacted individuals should remain vigilant to protect against fraud and/or identity theft by, among other things, reviewing their financial account statements and monitoring free credit reports. If individuals detect any suspicious activity on an account, they should promptly notify the institution or company with which the account is maintained. Individuals should also promptly report any fraudulent activity or any suspected identity theft to proper law enforcement authorities, including the police and their state’s attorney general. Individuals may also wish to review the tips provided by the Federal Trade Commission (“FTC”) on fraud alerts, free security/credit freezes and steps that they can take to avoid identity theft. For more information and to contact the FTC, please visit www.identitytheft.gov or call 1-877-ID-THEFT (1-877-438-4338).  Individuals may also contact the FTC at: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. Individuals may obtain a free security freeze by contacting any one or more of the following national consumer reporting agencies:

For individuals seeking more information or questions about this incident or requesting assistance in enrolling in credit monitoring, please call 1-800-405-6108 between 8:00 a.m. to 8:00 p.m. Eastern Time, Monday through Friday, excluding holidays. In addition, individuals may visit M&R’s website for more information at https://www.mrhotelgroup.com/. 

M&R takes seriously its responsibility to protect the privacy of the information in its care, and understands the frustration, concern, and inconvenience this incident may have caused. To help mitigate the possibility of a similar incident from occurring again, M&R has implemented additional safeguards and enhanced security measures to better protect the privacy and security of information in our systems. We have also reviewed and taken steps to enhance our policies and procedures relating to the security of our systems, as well as our information life cycle management.