HackingTechnologyInformationStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

CITRIX SYSTEMS, INC.

bd_1596488bc59a7f4e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 6, 2019

Filed

Apr 29, 2019

To disclose

8 weeks

Affected

10state residents only

Linked

3 filings

Confidence

65%

Full breach record for CITRIX SYSTEMS, INC. →2 incidents on file

Citrix Systems notified employees in Montana and other states of a cyberattack where international criminals accessed the internal network between Oct 2018 and Mar 2019. The FBI informed Citrix on March 6, 2019. Data potentially exposed included names, SSNs, and financial info. Citrix engaged forensic firms, cooperated with the FBI, and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 144 days

discovery → filing · 8 weeks / 54 days

Oct 13, 2018

Begins

Mar 6, 2019

Discovered

Apr 29, 2019

Filed

vs. sector median

11 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_8da1d26120801d862019-04-29Verified
New Hampshire State AGbd_33705d2dc689cf652019-04-30 · +1dVerified

Name: CITRIX SYSTEMS, INC.
norm: citrix systems

Name: CITRIX SYSTEMS, INC.
norm: citrix systems
Industry: Technologyllm

Discovered: Mar 6, 2019
Breach occurred: Oct 13, 2018 – Mar 8, 2019
Undetected for: 144 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 29, 2019
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified FBI
Initial access: valid_credentials

During the incident: Engaged leading cyber security firms to assist with forensic investigation
Cooperating with the FBI in connection with their investigation
Taken measures to remove the cyber criminals' access to systems
Monitoring for signs of further activity or compromise
Provided complimentary one-year credit monitoring, dark web monitoring, and identity restoration service through Equifax
Changes made: Introduced measures to expel the cyber criminals from its systems
Investing in resources and technology to improve internal security
Conducting a comprehensive review of security and evaluating next steps
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGApr 29 · first

Montana State AGApr 29 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-Pages-from-Citrix_US_Montana_Regulator_Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2019
Raw hash: a6f2e6c41f6f795bdaab44bf16681fa09a907a1c574092945ec9c75abcdbd70c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCITRIX SYSTEMS, INC.

Victim entityCITRIX SYSTEMS, INC.

Incidentdiscovered Mar 6, 2019

Stated responseEngaged leading cyber security firms to assist with forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov