HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

US Airways, Inc.

bd_63170fdb51ed5b82 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 2, 2013

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for US Airways, Inc. →3 incidents on file

US Airways notified California regulators of a breach affecting Dividend Miles accounts. Unauthorized users obtained usernames and passwords for compromised accounts. Potentially accessed data includes names, addresses, emails, security questions, dates of birth, Known Traveler numbers, and the last four digits of credit cards. A limited number of accounts had mileage improperly taken. US Airways deactivated passwords, reset credentials, disabled security questions, and contracted with LifeLock for one year of credit monitoring services. The investigation is ongoing with federal law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Aug 2, 2013

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_0cb8e8f9e73da5e92013-08-02Verified

Name: US Airways, Inc.
norm: us airways

Name: US Airways, Inc.
norm: us airways
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 1, 2013 – Oct 27, 2013
Materiality determined: Oct 27, 2013
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Deactivated your current password and provided you with a new password
Disabled the security questions and answers
Working with U.S. federal law enforcement
Contracted with LifeLock to provide you a free one year membership in LifeLock’s credit monitoring program
Changes made: Working to ensure that additional measures are taken to protect personally identifiable information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGAug 2 · first

California State AGAug 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-42383
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 2, 2013
Raw hash: 6388fb118c14c9c7ff5f9d6b04424d9baef03ec72332531f5ec3a5bbf9b79cd8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUS Airways, Inc.

Victim entityUS Airways, Inc.

IncidentUnauthorized Access

Stated responseDeactivated your current password and provided you with a new password

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov