HackingTelecom & MediaInformationVulnerability ExploitCustomer Data InvolvedIdentity (basic)CredentialsBehaviorLowContained

The Rodgers & Hammerstein Organization

bd_49d397589a104d64 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 9, 2019

Filed

Oct 15, 2019

To disclose

5 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for The Rodgers & Hammerstein Organization →

On September 9, 2019, The Rodgers & Hammerstein Organization (R&H Theatricals) experienced a security incident where a hacker exploited a vulnerability on RNH.com to access and download user account information, including usernames, email addresses, encrypted passwords, and order history. The company contained the incident, reset passwords, and offered identity theft protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 9, 2019 → Notified Oct 15, 201936d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 36 days

Sep 9, 2019

Begins

Sep 9, 2019

Discovered

Oct 15, 2019

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Illinois State AGbd_ecb44d9a872b4fb92019-01-01 · +287dCandidate

Name: The Rodgers & Hammerstein Organization
norm: the rodgers hammerstein organization
Domain: rnh.com

Name: The Rodgers & Hammerstein Organization
norm: the rodgers hammerstein organization
Domain: rnh.com
Industry: Telecom & Mediallm

Discovered: Sep 9, 2019
Breach occurred: Sep 9, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 15, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsBehavior
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Immediately updated the website to remediate this vulnerability and prevent further exploits
Reset your password on RNH.com
Partnered with ID Experts to provide this notification
Offering identity theft protection services through ID Experts
Changes made: Launching our new website in the coming months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: CA 60-day OK · 36d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 9, 2019
→ Notified: Oct 15, 2019
36d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 9, 2019 → Notified: Oct 15, 2019	36d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+287d · this page

Pattern: first filing Jan 1 (IL), last Oct 15 (CA) — a 287-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-183439
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2019
Raw hash: b550aeb62e2a1c41bf5bcd7da2f5be68f90d9a3135a031fcd3b3e424a6b6a27a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThe Rodgers & Hammerstein Organization

Victim entityThe Rodgers & Hammerstein Organization

Incidentdiscovered Sep 9, 2019

Stated responseImmediately updated the website to remediate this vulnerability and prevent further exploits

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov