> Choice Hotels says the database, while linked to the firm, was operated by a partner vendor and no internal Choice Hotels servers were accessed. "The vendor was working with the data as part of a proposal to provide a tool," a Choice Hotels spokesperson said.

> Due to the security lapse, the hotel franchise will not be working with the unnamed vendor in question.

I get the legal and business reasons not to name the vendor -- but at the same time, the only real punishment for this vendor is definitely not getting a contract with Choice Hotels.

(quotes from https://www.zdnet.com/article/700000-choice-hotels-records-l...)