HackingFinancial ServicesTechnologyFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)Financial accountMediumContained

AMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC.

bd_0ac803c23242c05f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 16, 2018

Filed

Mar 22, 2018

To disclose

6 days

Affected

6,627state residents only

Linked

6 filings

Confidence

66%

Full breach record for AMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC. →443 incidents on file

American Express Travel Related Services Company notified Washington AG of a breach at third-party vendor Orbitz. Unauthorized access to Amextravel.com booking data occurred between Jan 1, 2016 and Dec 22, 2017. 6,627 Washington residents affected. Data included names, card numbers, DOB, contact info. No SSNs or CVVs involved. Orbitz remediated; Amex offers 2 years credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 805 days

discovery → filing · 6 days

Jan 1, 2016

Begins

Mar 16, 2018

Discovered

Mar 22, 2018

Filed

vs. sector median

9 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Part of Orbitz Worldwide, LLC supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_73f028e269ca8c3a2018-03-22Verified by operator
Massachusetts State AGbd_56a5f7843c5167a12018-03-21 · +1dVerified
Massachusetts State AGbd_a0c510dbbe6ad7ed2018-05-02 · +41dCandidate
Massachusetts State AGbd_7454f265dc34e7502018-05-23 · +62dCandidate

Show 1 more filing ↓up to 97d gap

Massachusetts State AGbd_fe4f7cdf80fdfc2d2018-06-27 · +97dCandidate

Name: AMERICAN EXPRESS COMPANY
norm: american express
Domain: americanexpress.com

Name: AMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC.
norm: american express travel related
Domain: americanexpress.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Mar 16, 2018
Breach occurred: Jan 1, 2016 – Dec 22, 2017
Undetected for: 805 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2018
Affected individuals: 6,627state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the Washington Attorney General
Third party: via Orbitz
Initial access: external_remote_services

During the incident: Orbitz has remediated its platform
American Express is working with Orbitz to further understand this incident
American Express is in the process of notifying our affected travel customers
American Express is offering to provide affected customers with two years of free credit monitoring services and identity theft protection services
Changes made: Offering two years of free credit monitoring services and identity theft protection services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 21 · first

California State AG+1d

Washington State AG+1d · this page

Massachusetts State AG+42d

Massachusetts State AG+63d

Massachusetts State AG+98d

Pattern: first filing Mar 21 (MA), last Jun 27 (MA) — a 98-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9774.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 22, 2018
Raw hash: 59688249511d788b9c5b328262107f61f8f9336c408d24fb39ab15029c0c4f38

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAMERICAN EXPRESS COMPANY

Victim entityAMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC.

Incidentdiscovered Mar 16, 2018

Stated responseOrbitz has remediated its platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com