HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Christie's Inc.

bd_3afd5c49c448d174 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 9, 2024

Filed

Jun 7, 2024

To disclose

29 days

Affected

Not disclosed

Linked

10 filings

Confidence

64%

Full breach record for Christie's Inc. →2 incidents on file

Christie's Inc. disclosed a cybersecurity incident where an unauthorized actor accessed systems and copied files between May 8-9, 2024. The company discovered the incident on May 9, 2024, and completed its review on May 30, 2024. Affected data included names and other personal information. Christie's engaged external experts, notified law enforcement, and offered 12 months of identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 9, 2024 → Notified May 30, 202421d ✓ CA 60-day OK29 days discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 29 days

May 8, 2024

Begins

May 9, 2024

Discovered

Jun 7, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Montana State AGbd_03c1a583e7ece3f42024-06-07Candidate
Maine State AGbd_2fcf3b9660b934752024-06-07Candidate
Oregon State AGbd_470f96c768ca05bb2024-06-07Verified
Washington State AGbd_54ca5b849889c95f2024-06-07Verified

Show 5 more filings ↓up to 7d gap

Vermont State AGbd_5b5247becf5f90ac2024-06-07Verified
Indiana State AGbd_7945170e2852ccce2024-06-07Verified
Massachusetts State AGbd_82faa9e52eaf4ae42024-06-07Verified
Illinois State AGbd_1d40b0e0377a9b982024-06-01 · +6dVerified
New Hampshire State AGbd_23b1be388df840b02024-06-14 · +7dVerified

Name: Christie's Inc.
norm: christie s

Name: Christie's Inc.
norm: christie s
Industry: Retail & Consumerllm

Discovered: May 9, 2024
Breach occurred: May 8, 2024 – May 9, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 30, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified law enforcement

During the incident: Took steps to secure our environment
Launched an investigation
Engaged external cybersecurity experts to assist
Notified law enforcement and continue supporting their investigation
Arranged for a complimentary twelve-month subscription to CyEx Identity Defense Total
Changes made: Took additional steps to secure our systems
Continue to evaluate technical and organizational measures to avoid the reoccurrence of a similar incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: CA 60-day OK · 21d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 9, 2024
→ Notified: May 30, 2024
21d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 9, 2024 → Notified: May 30, 2024	21d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJun 1 · first

Montana State AG+6d

Maine State AG+6d

Oregon State AG+6d

Washington State AG+6d

Vermont State AG+6d

Indiana State AG+6d

Massachusetts State AG+6d

California State AG+6d · this page

New Hampshire State AG+13d

Pattern: first filing Jun 1 (IL), last Jun 14 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-586557
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2024
Raw hash: 23f6eebfcf4478beb895dbcf76ef40db02acee715a9fe16764c9f8752baa84c5

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityChristie's Inc.

Victim entityChristie's Inc.

Incidentdiscovered May 9, 2024

Stated responseTook steps to secure our environment

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov