HackingTelecom & MediaInformationCustomer Data InvolvedPIIIdentity (basic)LowContained

Home Box Office, Inc.

bd_3146fe89df84f797 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 31, 2017

Filed

Oct 30, 2017

To disclose

13 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Home Box Office, Inc. →

Home Box Office, Inc. (HBO) notified the California Attorney General of a cyber incident where an unauthorized third party accessed its IT network. The earliest evidence of access was May 15, 2017, with no further access after July 26, 2017. HBO became aware of the incident in late July 2017. Personal information was compromised. HBO is cooperating with law enforcement and offering 12 months of identity theft protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 31, 2017 → Notified Oct 31, 201792d ✗ CA 60-day late13 weeks discovery → filing

Incident timeline

undetected · 77 days

discovery → filing · 13 weeks / 91 days

May 15, 2017

Begins

Jul 31, 2017

Discovered

Oct 30, 2017

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_e61528eafdd5c8c82017-10-30Verified
Massachusetts State AGbd_fb8d25a442e5aa052017-10-30Verified
Montana State AGbd_071fcbcfcf5baf352017-11-13 · +14dVerified

Name: Home Box Office, Inc.
norm: home box office

Name: Home Box Office, Inc.
norm: home box office
Industry: Telecom & Mediallm

Discovered: Jul 31, 2017
Breach occurred: May 15, 2017 – Jul 26, 2017
Undetected for: 77 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 31, 2017
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Cooperating with law enforcement
Providing free identity theft prevention and mitigation services from AllClear ID, including credit monitoring, for twelve (12) months
Changes made: Implementing additional security measures, internal controls, and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(91 days from discovery to filing)
Compliance flags: CA 60-day late · 92d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 31, 2017
→ Notified: Oct 31, 2017
92d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 31, 2017 → Notified: Oct 31, 2017	92d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGOct 30 · first

Massachusetts State AGOct 30 · first

California State AGOct 30 · first · this page

Montana State AG+14d

Pattern: first filing Oct 30 (NH), last Nov 13 (MT) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-103102
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 30, 2017
Raw hash: 6e65f7b241d67c55302a1ce2338c4a7378349e856cc4a72783b8d3d294ab3e1c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHome Box Office, Inc.

Victim entityHome Box Office, Inc.

Incidentdiscovered Jul 31, 2017

Stated responseCooperating with law enforcement

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov