HackingTransportation & LogisticsTransportationStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Financial accountMediumContained

Southwest Airlines Co.

bd_1b64576b32a4b766 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2018

Filed

Jun 8, 2018

To disclose

14 weeks

Affected

244state residents only

Linked

6 filings

Confidence

66%

Full breach record for Southwest Airlines Co. →3 incidents on file

Southwest Airlines Co. filed a supplemental notice with the New Hampshire AG regarding a data incident involving its former third-party vendor, Orbitz. Unauthorized access occurred between Oct 1, 2017 and Dec 22, 2017. Data accessed included names, payment card numbers, and contact info for hotel reservations made via Southwest.com. 244 NH residents were notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 151 days

discovery → filing · 14 weeks / 99 days

Oct 1, 2017

Begins

Mar 1, 2018

Discovered

Jun 8, 2018

Filed

This filing is one of 6 filings about the same incident.View merged incident

Part of Orbitz Worldwide, LLC supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_231a0df655378b9e2018-04-21 · +48dVerified by operator
New Hampshire State AGbd_092a29de743168792018-04-20 · +49dVerified by operator
Washington State AGbd_ac5974af4b3890392018-04-20 · +49dVerified by operator
California State AGbd_f4cde765419b20102018-04-20 · +49dVerified by operator

Show 1 more filing ↓up to 49d gap

Oregon State AGbd_f508f42543c71c292018-04-20 · +49dCandidate

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Southwest Airlines Co.
norm: southwest airlines
Industry: Transportation & Logisticsnaics map

Discovered: Mar 1, 2018
Breach occurred: Oct 1, 2017 – Dec 22, 2017
Undetected for: 151 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 8, 2018
Affected individuals: 244state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Initial report to New Hampshire Attorney General's office on April 20, 2018Supplemental notification to New Hampshire Attorney General's office on June 8, 2018
Initial access: valid_credentials

During the incident: Orbitz took immediate steps to investigate the incident and enhance security and monitoring of the affected Orbitz platform
Orbitz brought in a leading third-party forensic investigation firm and other cybersecurity experts
Orbitz began working with law enforcement
Orbitz started working immediately to notify potentially impacted customers and business partners
Orbitz is offering one year of complimentary credit monitoring and identity protection service
Changes made: Enhanced security and monitoring of the affected Orbitz platform
Eliminated and prevented additional unauthorized access to the platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(99 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

New Hampshire State AGApr 20 · first

Washington State AGApr 20 · first

California State AGApr 20 · first

Oregon State AGApr 20 · first

Massachusetts State AG+1d

New Hampshire State AG+49d · this page

Pattern: first filing Apr 20 (NH), last Jun 8 (NH) — a 49-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/southwest-airlines-20180608.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2018
Raw hash: 34d8d6a2a6543726197ccda7c3c7c152bc14c8a11b52bb34f5a4fd639c803671

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entitySouthwest Airlines Co.

Incidentdiscovered Mar 1, 2018

Stated responseOrbitz took immediate steps to investigate the incident and enhance security and monitoring of the affected Orbitz platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov