HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsMediumContained

Vivendi Ticketing US, LLC

bd_1f7bb64bc077310a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 15, 2021

Filed

Oct 21, 2022

To disclose

18 months

Affected

7,841state residents only

Linked

8 filings

Confidence

70%

Full breach record for Vivendi Ticketing US, LLC →4 incidents on file

Vivendi Ticketing US LLC (d/b/a See Tickets US) notified Washington AG of unauthorized access to event checkout pages between June 2019 and Jan 2022. Discovered April 2021. Affected ~7,841 WA residents with name, address, and payment card data (PAN, expiry, CVV). Investigation ongoing; notification sent Oct 2022.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d18 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 660 days

discovery → filing · 18 months / 554 days

Jun 25, 2019

Begins

Apr 15, 2021

Discovered

Oct 21, 2022

Filed

vs. sector median

+72 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_54fbda4914db60872022-10-21Verified
Montana State AGbd_57af8d246f1d66372022-10-21Verified
Maine State AGbd_049137d5e49d3d0a2022-10-24 · +3dVerified
California State AGbd_2805835511f4b1cb2022-10-24 · +3dVerified

Show 3 more filings ↓up to 3d gap

Oregon State AGbd_34a562dc280872912022-10-24 · +3dVerified
Massachusetts State AGbd_8ecb73360b789bf12022-10-24 · +3dVerified
South Carolina State AGbd_e9c8d796190e92aa2022-10-24 · +3dVerified

Name: Orrick, Herrington & Sutcliffe LLP
norm: orrick herrington sutcliffe
Domain: orrick.com

Name: Vivendi Ticketing US, LLC
norm: vivendi ticketing us
Also named: Vivendi Ticketing US LLCdba oflegal entity
See Tickets USdba oftrade name
Industry: Retail & Consumerllm

Discovered: Apr 15, 2021
Breach occurred: Jun 25, 2019 – Jan 8, 2022
Undetected for: 660 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 21, 2022
Affected individuals: 7,841state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: NameFinancial account number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of a forensics firm
Took steps to shut down the unauthorized activity
Worked with Visa, MasterCard, American Express, and Discover to identify potentially affected pages and transactions
Coordination with law enforcement
Changes made: Deploy additional safeguards onto its systems
Strengthening its security monitoring, authentication, and coding
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(554 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGOct 21 · first

Montana State AGOct 21 · first

Washington State AGOct 21 · first · this page

Maine State AG+3d

California State AG+3d

Oregon State AG+3d

Massachusetts State AG+3d

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14012.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2022
Raw hash: 948e79f41f378aabbd905a19698339ad31a38f918ed9fd4cf4d5716ce267d71a

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityOrrick, Herrington & Sutcliffe LLP

Victim entityVivendi Ticketing US, LLC

Incidentdiscovered Apr 15, 2021

Stated responseLaunched an investigation with the assistance of a forensics firm

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com