Social EngineeringRetail & ConsumerHospitalityRetailPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsCredentialsHealth (basic)PHIMediumResolved

Golden Entertainment, Inc.

bd_4e61ebfd9fb97324 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 31, 2020

To disclose

—

Affected

734state residents only

Linked

2 filings

Confidence

66%

Full breach record for Golden Entertainment, Inc. →4 incidents on file

Golden Entertainment, Inc. disclosed an email phishing incident where an unauthorized individual accessed employee email accounts between May 30, 2019, and October 6, 2019. The breach affected 734 California residents, exposing names, SSNs, passport numbers, payment card details, and health information. The company secured accounts, engaged forensic investigators, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

May 30, 2019

Begins

Jan 31, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_8334a634081d92722020-01-31Verified

Name: Golden Entertainment, Inc.
norm: golden entertainment

Name: Golden Entertainment, Inc.
norm: golden entertainment
Industry: Retail & ConsumerllmHospitalityllm

Discovered: —
Breach occurred: May 30, 2019 – Oct 6, 2019
Materiality determined: —
Notification sent: Jan 31, 2020
Affected individuals: 734state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsCredentialsHealth (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Took steps to secure the email accounts
Launched an investigation
Engaged a cybersecurity firm to assist
Conducted a comprehensive review of the emails and attachments
Mailed notification letters to affected individuals
Provided substitute notice by issuing a press release and posting a notification on its website
Emailed individuals for whom it does not have a mailing address
Offered one year of complimentary credit monitoring and identity theft protection services through Experian
Established a call center for the individuals to call with any questions
Changes made: Implementing additional safeguards and technical measures, including multi-factor authentication
Providing additional training to employees
Providing additional phishing-awareness training to our employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 31 · first

California State AGJan 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-186886
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2020
Raw hash: 8e3b0209c43bf526e0752588b238ee54b0d18305a9f45159e096dcb776636f7b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGolden Entertainment, Inc.

Victim entityGolden Entertainment, Inc.

IncidentPhishing

Stated responseTook steps to secure the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov