MalwareTechnologyTransportation & LogisticsInformationBackdoor / C2Data MishandlingSupply Chain (3P Vendor)Customer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountFinancial credentialsHighContained

Delta Air Lines, Inc.

bd_3fd5fb2b29a0de18 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 28, 2018

Filed

Apr 11, 2018

To disclose

14 days

Affected

825,000

Linked

4 filings

Confidence

65%

Full breach record for Delta Air Lines, Inc. →6 incidents on file

Delta Air Lines notified customers and regulators of a cyber incident involving third-party vendor [24]7.ai. Malware in the vendor's chat software on delta.com desktop captured payment card data (name, address, card number, CVV, expiration) for customers who made purchases between Sept 26 and Oct 12, 2017. Delta engaged law enforcement and forensics, and is offering 2 years of credit monitoring to up to 825,000 affected US customers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 183 days

discovery → filing · 14 days

Sep 26, 2017

Begins

Mar 28, 2018

Discovered

Apr 11, 2018

Filed

vs. sector median

10 wks faster

This filing is one of 4 about the same incident.View merged incident

Part of [24]7.ai supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_286e451dc4b1279e2018-04-12 · +1dCandidate
Oregon State AGbd_766cb69bdc29cf102018-04-13 · +2dVerified by operator
California State AGbd_c8ee1d64322889022018-04-13 · +2dVerified

Name: Delta Air Lines, Inc.
norm: delta air lines
Domain: ir.delta.com

Name: Delta Air Lines, Inc.
norm: delta air lines
Domain: ir.delta.com
Industry: TechnologyllmTransportation & Logisticsllm

Discovered: Mar 28, 2018
Breach occurred: Sep 26, 2017 – Oct 12, 2017
Undetected for: 183 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 11, 2018
Affected individuals: 825,000state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1056 Input CaptureT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified state attorneys general
Initial access: supply_chain

During the incident: Engaged federal law enforcement and forensics teams
Launched its own investigation
Began mailing notices to potentially impacted customers
Established a call center to answer customers' questions
Established a dedicated website, delta.com/response
Changes made: Offering a paid subscription for AllClear ID credit monitoring and identity theft protection services at no cost to the customers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGApr 11 · first · this page

Montana State AG+1d

Oregon State AG+2d

California State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/delta-air-lines-20180411.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2018
Raw hash: 006d8b4f1b4160a173533047cf5c889c5dad6e5b860b45a1d6b4a641d51129ab

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDelta Air Lines, Inc.

Victim entityDelta Air Lines, Inc.

Incidentdiscovered Mar 28, 2018

Stated responseEngaged federal law enforcement and forensics teams

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov