HackingTechnologyInformationStolen CredentialsVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)Financial accountFinancial credentialsMediumContained

Condé Nast

bd_04324d8581f8ca87 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 24, 2019

Filed

May 9, 2019

To disclose

15 days

Affected · nationwide

1,1001 in this filing

Linked

3 filings

Confidence

66%

Condé Nast disclosed a cybersecurity incident affecting approximately 1,100 WIRED subscription transactions processed between April 14-17, 2019. An unauthorized party accessed a third-party vendor's systems, potentially acquiring names, addresses, and credit/debit card details. The incident was discovered on April 24, 2019. Affected individuals were notified on May 10, 2019, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 10 days

discovery → filing · 15 days

Apr 14, 2019

Begins

Apr 24, 2019

Discovered

May 9, 2019

Filed

vs. sector median

17 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_aaca5ea8ab9068e12019-05-11 · +2dVerified
New Hampshire State AGbd_280615d38ff462442019-05-17 · +8dVerified

Name: Condé Nast
norm: conde nast

Name: Condé Nast
norm: conde nast
Industry: Technologyllm

Discovered: Apr 24, 2019
Breach occurred: Apr 14, 2019 – Apr 17, 2019
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 10, 2019
Affected individuals: 1,100state + nationwide
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement
Initial access: external_remote_services

During the incident: Worked with our vendor to secure the subscription page
Notified law enforcement and credit/debit card companies about the incident
Offering you one year of Experian’s IdentityWorks credit monitoring and identity protection services at no cost to you
Changes made: Vendor has since enhanced its security measures and is evaluating additional steps to prevent this type of incident from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGMay 9 · first · this page

Massachusetts State AG+2d

New Hampshire State AG+8d

Pattern: first filing May 9 (MT), last May 17 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-INetCac.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2019
Raw hash: e64f57d2e8106b1309dbc8348ed63b4c5e3bbca20a3738434ad33f9afcfb0c9e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCondé Nast

Victim entityCondé Nast

Incidentdiscovered Apr 24, 2019

Stated responseWorked with our vendor to secure the subscription page

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov