HackingTechnologyInformationStolen CredentialsTargetedPIICredentialsLowActive

Home Box Office, Inc.

bd_071fcbcfcf5baf35 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 31, 2017

Filed

Nov 13, 2017

To disclose

15 weeks

Affected

3state residents only

Confidence

66%

Home Box Office, Inc. (HBO) notified Montana residents of a data breach in late July 2017 where an unauthorized third party accessed HBO's IT network. Personal information and user credentials were compromised. HBO is cooperating with law enforcement, implementing new security safeguards, and offering 12 months of free credit monitoring via AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 105 days

Jul 31, 2017

Discovered

Nov 13, 2017

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Home Box Office, Inc.
norm: home box office
Domain: hbomax.com

Name: Home Box Office, Inc.
norm: home box office
Domain: hbomax.com
Industry: Technologyllm

Discovered: Jul 31, 2017
Materiality determined: —
Notification sent: Oct 31, 2017
Affected individuals: 3state-resident count only
Data types: PIICredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Cooperating with law enforcement
Implementing additional security measures, internal controls, and safeguards
Providing free identity theft prevention and mitigation services from AllClear ID, including credit monitoring, for twelve (12) months
Changes made: Implementing additional security measures, internal controls, and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/HBO.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2017
Raw hash: d8385e00f5216e56ec82f89dd45b8f1803d8dac2aac4932116c1f9da143513ed

Reporting entityHome Box Office, Inc.

Victim entityHome Box Office, Inc.

Incidentdiscovered Jul 31, 2017

Stated responseCooperating with law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov