MisuseTechnologyInformationPrivilege AbuseEmployee Data InvolvedTargetedPIIFinancial accountIdentity (basic)LowContained

NETFLIX, INC.

bd_4272b1b05556dede · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 4, 2011

Filed

Apr 20, 2011

To disclose

16 days

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for NETFLIX, INC. →

Netflix notified the New Hampshire Attorney General that an internal call center employee accessed the credit card information of two NH residents without authorization between February and April 2011. Netflix terminated the employee, contacted law enforcement, and notified the residents.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 59 days

discovery → filing · 16 days

Feb 4, 2011

Begins

Apr 4, 2011

Discovered

Apr 20, 2011

Filed

vs. sector median

16 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_620b741271d5595d2011-04-25 · +5dVerified

Name: NETFLIX, INC.
norm: netflix

Name: NETFLIX, INC.
norm: netflix
Industry: Technologyllm

Discovered: Apr 4, 2011
Breach occurred: Feb 4, 2011 – Apr 4, 2011
Undetected for: 59 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 21, 2011
Affected individuals: 2state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Contacted law enforcement
Began conducting an investigation
Terminated our relationship with the call center worker
Removing the individual’s access to Netflix facilities and information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 20 · first · this page

Massachusetts State AG+5d

Pattern: first filing Apr 20 (NH), last Apr 25 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/netflix-20110420.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 20, 2011
Raw hash: d693d6b3ad42d7d7317d34b884e164ae58d17bcf59b428311015347b6e0be5ca

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNETFLIX, INC.

Victim entityNETFLIX, INC.

Incidentdiscovered Apr 4, 2011

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov