HackingVulnerability ExploitCustomer Data InvolvedIDENTITY_BASICCREDENTIALSBEHAVIORLowContained
The Rodgers & Hammerstein Organization
bd_49d397589a104d64 · schema v1 · pii pii-v1
Full breach record for The Rodgers & Hammerstein Organization →On September 9, 2019, The Rodgers & Hammerstein Organization (R&H Theatricals) experienced a security incident where a hacker exploited a vulnerability on RNH.com to access and download user account information, including usernames, email addresses, encrypted passwords, and order history. The company contained the incident, reset passwords, and offered identity theft protection services.
California clockDiscovered Sep 9, 2019 → Notified Oct 15, 201936d ✓ CA 60-day OK5 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-183439
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 15, 2019
- Raw hash
- b550aeb62e2a1c41bf5bcd7da2f5be68f90d9a3135a031fcd3b3e424a6b6a27a
Reporting entity
- Name
- The Rodgers & Hammerstein Organizationnorm: the rodgers hammerstein organization
- Domain
- rnh.com
Victim entity
- Name
- The Rodgers & Hammerstein Organizationnorm: the rodgers hammerstein organization
- Domain
- rnh.com
Incident
- Discovered
- Sep 9, 2019
- Materiality determined
- —
- Notification sent
- Oct 15, 2019
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALSBEHAVIOR
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 5 weeks(36 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 36d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 9, 2019→ Notified: Oct 15, 201936d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.