Social EngineeringTelecom & MediaInformationPhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

Altice USA, Inc.

bd_348949068d5d5410 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 13, 2019

Filed

Feb 5, 2020

To disclose

12 weeks

Affected

13state residents only

Linked

5 filings

Confidence

66%

Full breach record for Altice USA, Inc. →2 incidents on file

Altice USA, Inc. notified the NH AG of a phishing incident where unauthorized third parties stole employee credentials to access Office365 email accounts. The incident occurred Nov 4, 2019–Jan 2020; discovered Nov 13, 2019. 13 NH residents affected. Data included names, SSNs, DOBs, driver's licenses. Remediation included password resets, MFA implementation, and 1-year credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 12 weeks / 84 days

Nov 4, 2019

Begins

Nov 13, 2019

Discovered

Feb 5, 2020

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_09c6a9be75273f432020-02-06 · +1dVerified
Indiana State AGbd_0d95d583ad05f5122020-02-06 · +1dVerified
Montana State AGbd_814aa050fb075bd72020-02-06 · +1dCandidate
California State AGbd_c5b245d7b3a5aed92020-02-06 · +1dVerified

Name: Altice USA, Inc.
norm: altice usa

Name: Altice USA, Inc.
norm: altice usa
Industry: Telecom & Mediallm

Discovered: Nov 13, 2019
Breach occurred: Nov 4, 2019 – Jan 31, 2020
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 6, 2020
Affected individuals: 13state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Secured the email accounts
Launched an investigation
Conducted an in depth review of the email accounts
Notified law enforcement
Retained an expert computer forensics firm to conduct a thorough investigation
Contacted a third-party, Kroll, who assisted with identifying locations for the impacted individuals
Changes made: Reset passwords for all compromised accounts
Conducting additional mandatory education to help employees recognize and avoid phishing emails
Revising internal policies and practices to strengthen our internal security standards
Strengthening email system security controls and protocols
Working to implement multi-factor authentication and other enhanced authentication protocols
Providing access to free identity theft protection, credit monitoring, identity theft consultation and restoration for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGFeb 5 · first · this page

Massachusetts State AG+1d

Indiana State AG+1d

Montana State AG+1d

California State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/altice-usa-20200205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 5, 2020
Raw hash: f6ddb6af975744a299b88d169aa974f648662b92627b203b6615e5809bd762ed

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAltice USA, Inc.

Victim entityAltice USA, Inc.

Incidentdiscovered Nov 13, 2019

Stated responseSecured the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov