Okemo Announces Recent Security Breach

Okemo opens new Superpipe in Jan. 2002. Photo: Transworld SnowboardingOFFICIAL PRESS RELEASE – Okemo Mountain Resort announced Tuesday, April 1, that it has been a recent target of criminal efforts to gain access to credit data by infiltration of its computer network at Okemo Mountain Ski Area. Okemo believes the intruder gained potential access to credit card data including cardholder names, account numbers and expiration dates. An expert in data security and forensics hired by Okemo to assist in the investigation and response to the incident has informed Okemo that its computer system was improperly accessed by an outside party for a 16 day period between February 7, 2008 and February 22, 2008. Affected consumers potentially include those who used their credit cards at Okemo during such dates as well as those who did so from January through March of 2006.

The exact number of cardholders affected is unknown at this time. The forensic review determined that the intruder may have accessed credit card data from up to 28,168 credit card transactions processed at Okemo during the 16 day period in February. The actual number of credit cards holders involved in the transactions is likely to be smaller because multiple transactions may have been processed on a single card. In addition, there may have been access to 18,401 individual credit cards used at Okemo from January through March 2006, many of which are believed to have expired. The forensic expert determined that there was no evidence of any security breach to the computer systems at Mount Sunapee or Crested Butte.

Upon discovery of this intrusion, Okemo promptly initiated security measures to block the infiltration and protect any personal information transmitted through its system from any further unauthorized access. Okemo has provided
notice to Visa, MasterCard and American Express and is cooperating fully with the credit card companies to notify potentially affected cardholders. Okemo does not have sufficient information to directly contact cardholders.
Okemo has been informed that the banks, which issued the credit cards, will be provided with information necessary to notify their cardholders. Okemo has also notified law enforcement and is providing notice to State Attorneys General and appropriate regulatory agencies. Okemo will continue to carefully monitor the security of its systems moving forward.

Okemo has been advised by Federal law enforcement officials that the matter is currently under investigation. Okemo recommends that all cardholders carefully review their credit card statements and credit reports and remain
alert for any unauthorized or suspicious activity. Further, Okemo recommends that cardholders consider monitoring free credit reports that are available through the three major credit agencies, the contact information for which is listed below.

Okemo will provide updates on this incident on its website okemo.com. For further information or assistance, cardholders are encouraged to call the following Toll Free Number, 1-866-756-5366. Okemo can also be contacted at
Okemo Mountain Resort, 77 Okemo Ridge Road, Ludlow, VT 05149. Listed below is the contact information for the major credit reporting agencies and the Federal Trade Commission. Individuals may obtain
information from these sources about steps they can take to obtain free credit reports and place a fraud alert or security freeze on their credit report and file.

Contact Information for Credit Reporting Agencies and the Federal Trade Commission

PO Box 740241
Atlanta, GA 30374-0241

PO Box 2104
Allen, TX 75013

PO Box 1000
Chester, PA 19022

The Federal Trade Commission
600 Pennsylvania Avenue, NW
Washington, DC 20580

Special Notice to Massachusetts Residents:
Under Massachusetts law, Massachusetts residents who have been affected have the right to file a police report with respect to this incident. Massachusetts residents also have the right to request a security freeze. To place a security freeze, a consumer needs to send a written request to each of the three credit bureaus. The contact information for each of these
agencies is listed below. A security freeze request must include the consumer's name, address, date of birth, social security number, and credit card number and expiration date for payment, if applicable. Each credit bureau has specific requirements for placing a security freeze, so consumers should contact each bureau for more information. Please note that if you have been a victim of identify theft and you provide a police report to the credit reporting agency, the agency cannot charge you for placing, lifting or removing a security freeze. If you do not have such a police report, the credit reporting union may charge up to $5 per transaction for placing, lifting or removing the security freeze.

Special Notice to Maryland Residents
Maryland residents should take note of the contact information for the major consumer reporting agencies listed above. The Maryland Attorney General's Office can be contacted at Attorney General Douglas F. Ganser, Consumer Protection Division, Office of the Attorney General, 200 St. Paul Place, Baltimore, MD 21202, 1-888-743-0023.