Interstate Management Data Breach
The 2025 Interstate Management Company data breach affected 22,743 people according to the Indiana Attorney General's record. The official notice says the incident occurred in certain systems at The Westin San Diego Bayview, which the company operates.
Exposed Data Types
2 sensitive6- Medical information
- Health insurance information
- Names
- Social security numbers
- Payment card information
- Financial information
About This Breach
Interstate Management Company is a hotel operator based in Plano, Texas. The disclosed scope of this event was limited to The Westin San Diego Bayview in San Diego, California, which the company manages.
How Did the Incident Occur?
Interstate Management confirmed on April 23, 2026, that personal information may have been accessed or taken from certain hotel systems between November 19 and November 22, 2025. The company secured its systems, investigated what happened, and reviewed the affected files to identify the information and people involved.
What Information Was Affected?
The information varied by person. The New Hampshire notice identifies names, Social Security numbers, and payment-card information, while the Texas Attorney General's record also lists financial, medical, and health-insurance information. It does not indicate that every information type applied to every person.
How Did Interstate Management Respond?
The company assessed the security of its systems, investigated the event, notified law enforcement, and began implementing additional safeguards and employee training. It sent written notices to affected people and offered one year of complimentary credit monitoring and identity-protection services.
What Should Affected People Do?
Notice recipients should check their letters for the monitoring-service enrollment deadline and review credit reports, payment-card activity, health-insurance explanations, and unexpected medical-service records. People whose Social Security numbers were involved may consider a fraud alert or credit freeze based on their circumstances and should independently verify unexpected messages requesting identity or payment information in connection with hotel stays.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
