MisuseTelecom & MediaInformationPrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPIIFinancial accountLowContained

SIRIUS XM HOLDINGS INC.

bd_4971c99783872299 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 19, 2012

Filed

Apr 6, 2012

To disclose

18 days

Affected

234

Confidence

66%

Full breach record for SIRIUS XM HOLDINGS INC. →4 incidents on file

Sirius XM Radio Inc. notified the NH AG of a security breach involving its contractor, Stream International Global Services Philippines, Inc. On March 19, 2012, three call center employees were detected recording unencrypted credit card information of customers in violation of protocol. 234 individuals were affected, including 1 NH resident. Sirius suspended the employees, investigated the site, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 days

Mar 19, 2012

Begins

Mar 19, 2012

Discovered

Apr 6, 2012

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed234 affectedView incident

Name: SIRIUS XM HOLDINGS INC.
norm: sirius xm
Domain: siriusxm.com

Name: SIRIUS XM HOLDINGS INC.
norm: sirius xm
Domain: siriusxm.com
Industry: Telecom & Mediallm

Discovered: Mar 19, 2012
Breach occurred: Mar 19, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2012
Affected individuals: 234state + nationwide
Data types: PIIFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Regulator citations: Provided notice to the New Hampshire Office of the Attorney General
Third party: via Stream International Global Services Philippines, Inc.
Initial access: insider_action

During the incident: Employees at issue were placed on immediate suspension
Stream intends to pursue charges against the individuals
Caused an investigation to be made of all of its other employees at that site
Entered into an agreement with a credit monitoring service to monitor the affected persons’ credit reports for 24 months
Engaged Trust ID, Inc. to provide credit monitoring service for two years
Changes made: Ensured that all necessary protocols were adhered to and improved, as appropriate
Continuously monitoring our processes and those of our contractors to prevent similar occurrences
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sirius-xm-radio-20120406.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2012
Raw hash: 136ad51add57febf6d476ae7e9801c555660653bc6751112934e8e9198b5a3ff

Reporting entitySIRIUS XM HOLDINGS INC.

Victim entitySIRIUS XM HOLDINGS INC.

Incidentdiscovered Mar 19, 2012

Stated responseEmployees at issue were placed on immediate suspension

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov