HackingTechnologyInformationTargetedIdentity (basic)Financial accountLowContained

Dow Jones & Company, Inc.

bd_4aa8afcb75aa265e · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 19, 2015

Filed

Oct 9, 2015

To disclose

7 weeks

Affected

6state residents only

Linked

3 filings

Confidence

64%

Full breach record for Dow Jones & Company, Inc. →

Dow Jones & Company notified affected individuals of an unauthorized third-party access to a server containing customer registration data, including names, addresses, and payment card information. The incident was discovered on August 19, 2015. No evidence of data misuse was found. Dow Jones engaged in investigation, secured systems, and provided 24 months of identity protection services via AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 51 days

Aug 19, 2015

Discovered

Oct 9, 2015

Filed

vs. sector median

11 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_b016736e51f2deba2015-10-09Verified
New Hampshire State AGbd_ec3832a5a7dd41362015-10-09Verified

Name: Dow Jones & Company, Inc.
norm: dow jones

Name: Dow Jones & Company, Inc.
norm: dow jones
Industry: Technologyllm

Discovered: Aug 19, 2015
Materiality determined: —
Notification sent: Oct 9, 2015
Affected individuals: 6state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Provided notice to certain state regulators

During the incident: Initiated an investigation as soon as we learned of the potential unauthorized access
Identified and closed the known access paths
Taken further steps to secure our systems
Provided notice of this incident to our potentially impacted customers
Provided notice to certain state regulators
Created a dedicated toll free number staffed with professionals
Arranged to have AllClear ID provide Identity protection services for 24 months at no cost
Changes made: Examining ways we can prevent incidents of this kind from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 9 · first

New Hampshire State AGOct 9 · first

Montana State AGOct 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Dow-Jones-Company.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2015
Raw hash: a1338da4824790f2eb14e455e37af7d8f6557f8ce6ab8257b382598d6373da0f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDow Jones & Company, Inc.

Victim entityDow Jones & Company, Inc.

Incidentdiscovered Aug 19, 2015

Stated responseInitiated an investigation as soon as we learned of the potential unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov