HackingCustomer Data InvolvedMedium
Amtrak
bd_3b6e36d60242cb51 · schema v1 · pii pii-v1
Full breach record for Amtrak →On July 24, 2020, National Railroad Corporation (Amtrak) discovered an external system breach that occurred on the same day. The breach affected 49,289 individuals. Amtrak provided written notification to affected consumers on November 5, 2020, and offered 12 months of identity theft protection services through Experian.
Maine clockDiscovered Jul 24, 2020 → Filed with AG Nov 4, 2020103d ✗ ME AG >90d15 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed49,289 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d8426958-299c-4776-8241-c722acbb105c.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 4, 2020
- Raw hash
- 123cda5c5b3fa365816fb5ffca9a0c324bcea8609197199cfc7262b82d7cbece
Reporting entity
- Name
- Amtraknorm: amtrak
- Domain
- amtrak.com
Victim entity
- Name
- Amtraknorm: amtrak
- Domain
- amtrak.com
Incident
- Discovered
- Jul 24, 2020
- Materiality determined
- —
- Notification sent
- Nov 5, 2020
- Affected individuals
- 49,289
- Data types
- —
- Attack vector
- Unauthorized Access
- Threat actor
- External
Compliance
- Time to disclose
- 15 weeks(103 days from discovery to filing)
- Compliance flags
- ME AG >90d · 103dME resident >60d · 104d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 24, 2020→ Filed with AG: Nov 4, 2020103d 90 days ME AG >90d Maine Discovered: Jul 24, 2020→ Notified: Nov 5, 2020104d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.