HackingTransportation & LogisticsTransportationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

American Airlines Group Inc.

bd_4107d48e72fc1b9c · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 3, 2023

Filed

Jun 23, 2023

To disclose

7 weeks

Affected

4state residents only

Linked

5 filings

Confidence

66%

Full breach record for American Airlines Group Inc. →6 incidents on file

American Airlines, Inc. notified Montana residents of a cybersecurity incident involving third-party vendor pilotcredentials.com. An unauthorized actor accessed vendor systems on or around April 30, 2023, obtaining pilot and cadet applicant data including names, SSNs, driver's licenses, and passport numbers. American discovered the incident on May 3, 2023, notified law enforcement, and offered two years of Experian IdentityWorks. Notices were sent June 23, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 7 weeks / 51 days

Apr 30, 2023

Begins

May 3, 2023

Discovered

Jun 23, 2023

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_7b8b9f856e98de172023-07-19 · +26dVerified by operator

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_44cbb80b5fb5356b2023-06-23Candidate
Massachusetts State AGbd_999240a5230010c22023-06-23Verified
Indiana State AGbd_ee128d7305b781242023-06-23Verified

Name: American Airlines Group Inc.
norm: american airlines
Domain: aa.com

Name: American Airlines Group Inc.
norm: american airlines
Domain: aa.com
Industry: Transportation & Logisticsllm

Discovered: May 3, 2023
Breach occurred: Apr 30, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 23, 2023
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement and is cooperating with their investigation
Initial access: supply_chain

During the incident: Launched an investigation
Worked with third-party vendor to obtain more information and respond to the incident
Conducted a robust review of the files involved to identify individuals whose personal information may have been involved
Notified law enforcement and is cooperating with their investigation
Offering you a complimentary two-year membership of Experian’s IdentityWorksSM Credit 3B
Changes made: Moving forward, pilot and cadet applicants will be directed to an internal portal managed by American
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJun 23 · first

Massachusetts State AGJun 23 · first

Indiana State AGJun 23 · first

Montana State AGJun 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-363.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 23, 2023
Raw hash: 69dd0e2e74d81c3105aa0df6cd9c6d7ba8787d29979ce5bcd92e0bc84c6621a1

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityAmerican Airlines Group Inc.

Victim entityAmerican Airlines Group Inc.

Incidentdiscovered May 3, 2023

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov