HackingTechnologyRetail & ConsumerInformationVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

ARISTOCRAT TECHNOLOGIES, INC.

bd_502db1048f27713a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2023

Filed

Sep 20, 2023

To disclose

16 weeks

Affected

5state residents only

Linked

7 filings

Confidence

64%

Full breach record for ARISTOCRAT TECHNOLOGIES, INC. →

Aristocrat Technologies, Inc. notified Montana residents of a data breach involving MOVEit Transfer software. Between May 29-31, 2023, attackers exploited a previously unknown vulnerability to exfiltrate personal data including SSNs and government IDs. Aristocrat discovered the incident on June 1, 2023, contained the breach, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 16 weeks / 111 days

May 29, 2023

Begins

Jun 1, 2023

Discovered

Sep 20, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_e8c722d5edffc20e2023-07-26 · +56dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_220882196d8d5ed72023-09-20Verified by operator
Maine State AGbd_435e1eee74ecf8a32023-09-20Candidate
Washington State AGbd_f6cfde1f457ae0a72023-09-20Verified
New Hampshire State AGbd_52c2b0ce02f743cc2023-09-21 · +1dVerified

Show 1 more filing ↓up to 1d gap

Indiana State AGbd_d625029d02653b4a2023-09-21 · +1dVerified

Name: ARISTOCRAT TECHNOLOGIES, INC.
norm: aristocrat technologies
Domain: aristocrat.com

Name: ARISTOCRAT TECHNOLOGIES, INC.
norm: aristocrat technologies
Domain: aristocrat.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: Jun 1, 2023
Breach occurred: May 29, 2023 – May 31, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 21, 2023
Affected individuals: 5state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notified relevant supervisory authorities and regulators
Initial access: exploit_public_facing

During the incident: Removed the impacted server from the network
Launched an investigation
Fixed the relevant software vulnerability
Notified law enforcement
Offering 24 months of complimentary credit monitoring and identity theft protection services
Changes made: Fixed the relevant software vulnerability
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(111 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGSep 20 · first

Maine State AGSep 20 · first

Washington State AGSep 20 · first

Montana State AGSep 20 · first · this page

New Hampshire State AG+1d

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-697.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2023
Raw hash: 97d8273591199f370fbf086136a6fddc1d9e0bfdf8e5c1a53f227c5c0b0e3253

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityARISTOCRAT TECHNOLOGIES, INC.

Victim entityARISTOCRAT TECHNOLOGIES, INC.

Incidentdiscovered Jun 1, 2023

Stated responseRemoved the impacted server from the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov