HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)CredentialsLowContained

Regency Theatres

bd_53081f95ccf325e7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 1, 2018

Filed

Jun 19, 2018

To disclose

18 days

Affected

Not disclosed

Confidence

64%

Regency Theatres disclosed that an unauthorized third party accessed customer account information on its website in January 2018. The breach was discovered in early June 2018. Affected data included names, addresses, email addresses, encrypted passwords, and rewards card numbers. The company identified and removed the exploited vulnerability and engaged security experts. Customers were offered 12 months of identity protection via AllClear ID.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 1, 2018 → Notified Jun 18, 201817d ✓ CA 60-day OK18 days discovery → filing

Incident timeline

undetected · 151 days

discovery → filing · 18 days

Jan 1, 2018

Begins

Jun 1, 2018

Discovered

Jun 19, 2018

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Regency Theatres
norm: regency theatres
Domain: regencycinemas.com

Name: Regency Theatres
norm: regency theatres
Domain: regencycinemas.com
Industry: Retail & Consumerllm

Discovered: Jun 1, 2018
Breach occurred: Jan 1, 2018 – Jan 31, 2018
Undetected for: 151 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 18, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Successfully identified the vulnerability that was exploited in order to extract this data and have taken steps to remove it
Working closely with security experts to test and monitor our systems to prevent any future unauthorized access to customer data
Arranged to have AllClear ID protect your identity for 12 months at no cost
Changes made: Taken steps to remove the vulnerability
Working closely with security experts to test and monitor our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: CA 60-day OK · 17d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 1, 2018
→ Notified: Jun 18, 2018
17d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 1, 2018 → Notified: Jun 18, 2018	17d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-137238
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 19, 2018
Raw hash: c7742d5335a2234cc7a51244003a00d5fa24a5c6fc59d88393ab2dea02d0c011

Reporting entityRegency Theatres

Victim entityRegency Theatres

Incidentdiscovered Jun 1, 2018

Stated responseSuccessfully identified the vulnerability that was exploited in order to extract this data and have taken steps to remove it

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov