June 29, 2017
Addressee's Name
Title
Company Name
Number and Street
City, State and Zip
Country

NOTICE OF DATA BREACH
Dear [preferred name]:
We recently learned that certain hotel reservations made for Google business travel were
among the many reservations affected by a security incident impacting a third-party provider’s
electronic reservation system that serves thousands of travel agencies and hotels. This did not
affect Google’s systems. However, this incident impacted one of the travel providers used by
Googlers, Carlson Wagonlit Travel (CWT).
CWT has confirmed that one or more of your hotel reservations and the name, contact
information, and payment card information associated with the reservation(s) may have been
compromised. The protection of your personal information is a matter we take very seriously,
and we recommend that you review the information in this letter for some steps you can take to
protect yourself against potential misuse of your information.
What Happened?
A company named Sabre Hospitality Solutions operates the SynXis Central Reservations
system (CRS), which facilitates the booking of hotel reservations made by individuals and
companies, such as Google, through travel agencies. Sabre discovered unauthorized access to
an internal account in the SynXis CRS. Following an investigation, Sabre notified CWT, which
uses the SynXis CRS, that an unauthorized party gained access to personal information
associated with certain hotel reservations made through CWT. CWT subsequently notified
Google about the issue on June 16, 2017, and we have been working with CWT and Sabre to
confirm which Google travelers were affected.
What Information Was Involved?
The unauthorized party was able to access the name, contact information and payment card
data associated with certain hotel reservations maintained in the SynXis CRS between August
10, 2016 and March 9, 2017. Sabre’s investigation discovered no evidence that information
such as Social Security, passport, and driver’s license numbers were accessed. However,
because the SynXis CRS deletes reservation details 60 days after the hotel stay, we are not
able to confirm the specific information associated with every affected reservation.

 What We Are Doing
We are working with CWT and Sabre to address this issue. Sabre engaged a leading
cybersecurity firm to support its investigation. Sabre indicated that they also notified law
enforcement and the payment card brands about this incident.
We are offering you 24 months of complimentary identity protection and credit monitoring
services. These services, described below, will be provided by AllClear ID and are available as
of the date of this notice. You can use them at any time during the next 24 months:
AllClear Identity Repair: This service is automatically available to you with no enrollment
required. If a problem arises, call 1-866-979-2595 and an investigator will help recover
financial losses and restore your credit.
AllClear Credit Monitoring: This service offers additional layers of protection including
credit monitoring and a $1 million identity theft insurance policy. To use this service, you
will need to provide certain information to AllClear ID. You may sign up online at
enroll.allclearid.com or by phone by calling 1-866-979-2595 using the following
redemption code: [insert unique redemption code].
What You Can Do
We recommend that you remain vigilant for incidents of fraud and identity theft by regularly
reviewing your account statements and monitoring free credit reports for any unauthorized
activity. If you discover any suspicious or unusual activity on your accounts, be sure to report it
immediately to your financial institutions, as the major credit card companies have rules that
restrict them from requiring you to pay for fraudulent charges that are reported timely.
In addition, you may contact the Federal Trade Commission (FTC) or law enforcement
authorities, such as your state attorney general, to report incidents of identity theft or to learn
about steps you can take to protect yourself from identity theft. You can contact the FTC at:
Federal Trade Commission
600 Pennsylvania Avenue, NW
Washington, DC 20580
(877) IDTHEFT (438-4338)
https://www.identitytheft.gov/
If you find that your information has been misused, the FTC encourages you to file a complaint
with the FTC and to take these additional steps: (1) close the accounts that you have confirmed
or believe have been tampered with or opened fraudulently, and (2) file and keep a copy of a
local police report as evidence of the identity theft crime.

2

 Obtain Your Credit Report
You should also monitor your credit reports. You may periodically obtain credit reports from
each nationwide consumer reporting agency. If you discover inaccurate information or a
fraudulent transaction on your credit report, you have the right to request that the consumer
reporting agency delete that information from your credit report file.
In addition, under federal law, you are entitled to one free copy of your credit report every 12
months from each of the three nationwide consumer reporting agencies. You may obtain a free
copy of your credit report by going to www.AnnualCreditReport.com or by calling (877) 3228228. You also may complete the Annual Credit Report Request Form available from the FTC
at https://www.consumer.ftc.gov/articles/pdf-0093-annual-report-request-form.pdf, and mail it to
Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. You may
also contact any of the three major consumer reporting agencies to request a copy of your credit
report.
Place a Fraud Alert or Security Freeze on Your Credit Report File
In addition, you can obtain information from the FTC and the consumer reporting agencies
about fraud alerts and security freezes. A fraud alert can make it more difficult for someone to
get credit in your name because it tells creditors to follow certain procedures to protect you, but
it also may delay your ability to obtain credit. If you suspect you may be a victim of identity theft,
you may place a fraud alert in your file by calling just one of the three nationwide consumer
reporting agencies listed below. As soon as that agency processes your fraud alert, it will notify
the other two agencies, which then must also place fraud alerts in your file. An initial fraud alert
will last 90 days. An extended alert stays in your file for seven years. To place either of these
alerts, a consumer reporting agency will require you to provide appropriate proof of your identity,
which may include your Social Security number. If you ask for an extended alert, you will have
to provide an identity theft report.
Also, you can contact the nationwide consumer reporting agencies regarding if and how you
may place a security freeze on your credit report. A security freeze prohibits a consumer
reporting agency from releasing information from your credit report without your prior written
authorization, which makes it more difficult for unauthorized parties to open new accounts in
your name. Please be aware, however, that placing a security freeze on your credit report may
delay, interfere with, or prevent the timely approval of any requests you make for new loans,
credit mortgages, employment, housing, or other services. The consumer reporting agencies
have 3 business days after receiving a request to place a security freeze on a consumer’s credit
report. You may be charged to place or lift a security freeze. Unlike a fraud alert, you must
separately place a credit freeze on your credit file at each consumer reporting company.
You may contact the nationwide consumer reporting agencies at:
Equifax
P.O. Box 105788
Atlanta, GA 30348
(800) 525-6285
www.equifax.com

Experian
P.O. Box 9554
Allen, TX 75013
(888) 397-3742
www.experian.com

3

TransUnion
P.O. Box 2000
Chester, PA 19016
(800) 680-7289
www.transunion.com

 Please see the following pages for certain state-specific information.
For More Information
If you have any questions regarding this issue or you would like further information or
assistance, please do not hesitate to contact the Travel Team at p2phelp@google.com.
Sincerely,
[SIGNATURE]

4

 State-Specific Information
IF YOU ARE AN IOWA RESIDENT:
You may contact law enforcement or the Iowa Attorney General’s Office to report suspected
incidents of identity theft. This office can be reached at:
Office of the Attorney General of Iowa
Hoover State Office Building
1305 E. Walnut Street
Des Moines, IA 50319
(515) 281-5164
www.iowaattorneygeneral.gov
IF YOU ARE A MARYLAND RESIDENT:
You may obtain information about avoiding identity theft from the Maryland Attorney General’s
Office. This office can be reached at:
Office of the Attorney General
Consumer Protection Division
200 St. Paul Place
Baltimore, MD 21202
(888) 743-0023
www.marylandattorneygeneral.gov
IF YOU ARE A MASSACHUSETTS RESIDENT:
Under Massachusetts law, you have the right to obtain a police report in regard to this incident.
If you are the victim of identity theft, you also have the right to file a police report and obtain a
copy of it.
Massachusetts law allows consumers to place a security freeze on their credit reports. If you
have been a victim of identity theft, and you provide the consumer reporting agency with a valid
police report, it cannot charge you to place, lift, or remove a security freeze. In all other cases, a
consumer reporting agency may charge you up to $5.00 each to place, temporarily lift, or
permanently remove a security freeze. To place a security freeze on your credit report, you
must send a written request to each of the three major consumer reporting agencies, Equifax,
Experian, and TransUnion, by regular, certified, or overnight mail at the addresses below:
Equifax
P.O. Box 105788
Atlanta, GA 30348
www.equifax.com
(800) 525-6285

Experian
P.O. Box 9554
Allen, TX 75013
www.experian.com
(888) 397-3742

TransUnion
P.O. Box 2000
Chester, PA 19016
www.transunion.com
(800) 680-7289

To request a security freeze, you will need to provide the following information:
1. your full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security number;
3. date of birth;
4. if you have moved in the past five years, the addresses where you have lived over the prior
five years;

5

 5. proof of current address such as a current utility bill or telephone bill;
6. a legible photocopy of a government-issued identification card (state driver’s license or ID
card, military identification, etc.);
7. if you are a victim of identity theft, a copy of either the police report, investigative report, or
complaint to a law enforcement agency concerning identity theft;
8. if you are not a victim of identity theft, payment by check, money order, or credit card (Visa,
Mastercard, American Express, or Discover only). Do not send cash through the mail.
The consumer reporting agencies have three business days after receiving your request to
place a security freeze on your credit report. The consumer reporting agencies must also send
written confirmation to you within five business days and provide you with a unique personal
identification number (PIN) or password, or both, that can be used by you to authorize the
removal or lifting of the security freeze.
To lift the security freeze to allow a specific entity or individual access to your credit report, you
must call or send a written request to the consumer reporting agencies by mail and include
proper identification (name, address, and Social Security number) and the PIN number or
password provided to you when you placed the security freeze, as well as the identities of those
entities or individuals you would like to receive your credit report or the specific period of time
you want the credit report available. The consumer reporting agencies have three business
days after receiving your request to lift the security freeze for those identified entities or for the
specified period of time.
To remove the security freeze, you must send a written request to each of the three nationwide
consumer reporting agencies by mail and include proper identification (name, address, and
social security number) and the PIN number or password provided to you when you placed the
security freeze. The consumer reporting agencies have three business days after receiving your
request to remove the security freeze.
IF YOU ARE A NEW MEXICO RESIDENT:
You have rights under the federal Fair Credit Reporting Act (FCRA). These include, among
others, the right to know what is in your file; to dispute incomplete or inaccurate information; and
to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable
information.
For
more
information
about
the
FCRA,
please
visit
https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf or www.ftc.gov.
In Addition, New Mexico Consumers Have the Right to Obtain a Security Freeze or Submit a
Declaration of Removal
You may obtain a security freeze on your credit report to protect your privacy and ensure that
credit is not granted in your name without your knowledge. You may submit a declaration of
removal to remove information placed in your credit report as a result of being a victim of
identity theft. You have a right to place a security freeze on your credit report or submit a
declaration of removal pursuant to the Fair Credit Reporting and Identity Security Act.
The security freeze will prohibit a consumer reporting agency from releasing any information in
your credit report without your express authorization or approval. The security freeze is
designed to prevent credit, loans, and services from being approved in your name without your
consent. When you place a security freeze on your credit report, you will be provided with a

6

 personal identification number, password, or similar device to use if you choose to remove the
freeze on your credit report or to temporarily authorize the release of your credit report to a
specific party or parties or for a specific period of time after the freeze is in place. To remove the
freeze or to provide authorization for the temporary release of your credit report, you must
contact the consumer reporting agency and provide all of the following:
1. the unique personal identification number, password, or similar device provided by the
consumer reporting agency;
2. proper identification to verify your identity;
3. information regarding the third party or parties who are to receive the credit report or the
period of time for which the credit report may be released to users of the credit report; and
4. payment of a fee, if applicable.
A consumer reporting agency that receives a request from a consumer to lift temporarily a
freeze on a credit report shall comply with the request no later than three business days after
receiving the request. A consumer reporting agency shall comply with the request within 15
minutes of receiving the request by a secure electronic method or by telephone.
A security freeze does not apply in all circumstances, such as where you have an existing
account relationship and a copy of your credit report is requested by your existing creditor or its
agents for certain types of account review, collection, fraud control, or similar activities; for use
in setting or adjusting an insurance rate or claim or insurance underwriting; for certain
governmental purposes; and for purposes of prescreening as defined in the FCRA.
If you are actively seeking a new credit, loan, utility, telephone, or insurance account, you
should understand that the procedures involved in lifting a security freeze may slow your own
applications for credit. You should plan ahead and lift a freeze, either completely if you are
shopping around or specifically for a certain creditor, with enough advance notice before you
apply for new credit for the lifting to take effect. You should contact a consumer reporting
agency and request it to lift the freeze at least three business days before applying. If you
contact a consumer reporting agency by a secure electronic method or by telephone, the
consumer reporting agency should lift the freeze within 15 minutes. You have a right to bring a
civil action against a consumer reporting agency that violates your rights under the Fair Credit
Reporting and Identity Security Act.
To place a security freeze on your credit report, you must send a request to each of the three
major consumer reporting agencies: Equifax, Experian, and TransUnion. Contact these
agencies using the contact information provided in the enclosed letter.
IF YOU ARE A NORTH CAROLINA RESIDENT:
You may obtain information about preventing identity theft from the North Carolina Attorney
General’s Office. This office can be reached at:
North Carolina Department of Justice
Attorney General’s Office
9001 Mail Service Center
Raleigh, NC 27699-9001
(877) 566-7226

7

 http://www.ncdoj.gov
IF YOU ARE AN OREGON RESIDENT:
You may obtain information about preventing identity theft from the Oregon Attorney General’s
Office. This office can be reached at:
Oregon Department of Justice
1162 Court Street NE
Salem, OR 97301-4096
(503) 378-4400
http://www.doj.state.or.us/
IF YOU ARE A RHODE ISLAND RESIDENT:
You may contact law enforcement, such as the Rhode Island Attorney General’s Office, to
report incidents of identity theft or to learn about steps you can take to protect yourself from
identity theft. You can contact the Rhode Island Attorney General at:
RI Office of the Attorney General
150 South Main Street
Providence, RI 02903
(401) 274-4400
www.riag.ri.gov/
You may obtain a security freeze on your credit report to protect your privacy and ensure that
credit is not granted in your name without your knowledge. You have a right to place a security
freeze on your credit report pursuant to the Identity Theft Prevention Act of 2006.
The security freeze will prohibit a consumer reporting agency from releasing any information in
your credit report without your express authorization or approval. The security freeze is
designed to prevent credit, loans, and services from being approved in your name without your
consent. When you place a security freeze on your credit report, within five business days you
will be provided a personal identification number or password to use if you choose to remove
the freeze on your credit report or to temporarily authorize the release of your credit report for a
specific period of time after the freeze is in place. To provide that authorization, you must
contact the consumer reporting agency and provide all of the following:
1. the unique personal identification number or password provided by the consumer reporting
agency;
2. proper identification to verify your identity; and
3. the proper information regarding the period of time for which the report shall be available to
users of the credit report.
A consumer reporting agency that receives a request from a consumer to temporarily lift a
freeze on a credit report shall comply with the request no later than three business days after
receiving the request. A security freeze does not apply to circumstances where you have an
existing account relationship and a copy of your report is requested by your existing creditor or
its agents or affiliates for certain types of an account review, collection, fraud control, or similar
activities.

8

 If you are actively seeking a new credit, loan, utility, telephone, or insurance account, you
should understand that the procedures involved in lifting a security freeze may slow your own
applications for credit. You should plan ahead and lift a freeze -- either completely, if you are
shopping around, or specifically for a certain creditor -- with enough advance notice before you
apply for new credit for the lifting to take effect.
You have a right to bring a civil action against someone who violates your rights under the credit
reporting laws. The action can be brought against a consumer reporting agency or a user of
your credit report.
Unless you are 65 years of age or older, or you are a victim of identity theft with an incident
report or complaint from a law enforcement agency, a consumer reporting agency has the right
to charge you up to $10.00 to place a freeze on your credit report; up to $10.00 to temporarily lift
a freeze on your credit report, depending on the circumstances; and up to $10.00 to remove a
freeze from your credit report. If you are 65 years of age or older or are a victim of identity theft
with a valid incident report or complaint, you may not be charged a fee by a consumer reporting
agency for placing, temporarily lifting, or removing a freeze.
To place a security freeze on your credit report, you must send a request to each of the three
major consumer reporting agencies: Equifax, Experian, and TransUnion. These agencies can
be contacted using the contact information provided above.
To request a security freeze, you may need to provide the following information:
1. your full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security number;
3. date of birth;
4. complete address;
5. prior addresses;
6. proof(s) of identification (state driver’s license or ID card, military identification, birth certificate
etc.);
7. if you are a victim of identity theft, a copy of either the police report, investigative report, or
complaint to a law enforcement agency concerning identity theft; and
8. if you are not a victim of identity theft, payment. Do not send cash through the mail.

9