HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDPIIHighContained

ACTIVEOutdoors

bd_3a3e9bd5a930f883 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 22, 2016

Filed

Aug 22, 2016

To disclose

≤1 day

Affected

3,984state residents only

Linked

7 filings

Confidence

67%

Full breach record for ACTIVEOutdoors →2 incidents on file

Active Outdoors reported unauthorized access to its online hunting and fishing license applications for Idaho, Oregon, and Washington on August 22, 2016. The incident affected at least 3,984 Hawaii residents, exposing names, addresses, DOBs, driver's licenses, and SSNs for a subset. Access was limited to accounts created prior to July 2006/2007. Active Outdoors engaged forensic investigators, secured the systems, and provided credit monitoring and identity repair services to affected individuals.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due≤1 day discovery → filing

⚠ filing dateThe stored discovery date equals the regulator filing date, so no genuine detection date was captured.

Incident timeline

discovery → filing · ≤1 day / 0 days

Aug 22, 2016

Discovered

Aug 22, 2016

Filed

vs. sector median

19 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_0043817ab2e525462016-09-19 · +28dVerified
Oregon State AGbd_006cc551e87554182016-09-19 · +28dVerified
Montana State AGbd_64c2e5eba05780ba2016-09-19 · +28dVerified
New Hampshire State AGbd_c13c6eb011bc76532016-09-19 · +28dVerified

Show 2 more filings ↓up to 30d gap

Washington State AGbd_ecb93ee8934ad17a2016-09-19 · +28dVerified
South Carolina State AGbd_429f9fcfc33f638d2016-09-21 · +30dVerified

Name: ACTIVEOutdoors
norm: activeoutdoors

Name: ACTIVEOutdoors
norm: activeoutdoors
Industry: Technologyllm

Discovered: Aug 22, 2016
Materiality determined: —
Notification sent: Sep 19, 2016
Affected individuals: 3,984state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Hawaii Office of Consumer ProtectionWorking with impacted states and law enforcement in their own further investigations
Initial access: valid_credentials

During the incident: Launched an extensive investigation in coordination with the impacted states
Released updates to its applications to address the potential threat
Engaged a top-tier cybersecurity firm to conduct an independent comprehensive review
Providing notice to all affected individuals
Providing 24 months of identity repair and restoration services through AllClear ID at no cost
Providing 24 months of AllClear ID credit monitoring services for those with SSNs
Introduced additional security measures into the Affected Applications
Introduced further countermeasures into the production environment
Provided written notice, electronic notice, and statewide media notification
Established a publicly available website for inquiries
Established a dedicated toll-free call center
Provided notifications to the three major consumer reporting agencies
Changes made: Released updates to applications to address the potential threat
Introduced additional security measures into the Affected Applications to prevent this type of unauthorized access
Introduced further countermeasures into the production environment to prevent access and detect other forms of unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: filing dateThe stored discovery date equals the regulator filing date, so no genuine detection date was captured.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Hawaii State AGAug 22 · first · this page

California State AG+28d

Oregon State AG+28d

Montana State AG+28d

New Hampshire State AG+28d

Washington State AG+28d

South Carolina State AG+30d

Pattern: first filing Aug 22 (HI), last Sep 21 (SC) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://web.archive.org/web/20211024101019id_/https://cca.hawaii.gov/ocp/files/2016/09/OCP-2016-0445.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 22, 2016
Raw hash: 57e300cecaf770e2f398c1c8068a371c71e9cb99a993e0b8e54877ed5efaad00

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityACTIVEOutdoors

Victim entityACTIVEOutdoors

Incidentdiscovered Aug 22, 2016

Stated responseLaunched an extensive investigation in coordination with the impacted states

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenanceweb.archive.org