HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsPHIHealth (basic)MediumContained

PULAU Corporation

bd_647fb8ff9a8c914b · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 28, 2020

To disclose

—

Affected

4state residents only

Linked

5 filings

Confidence

66%

Full breach record for PULAU Corporation →

PULAU Corporation notified individuals of unauthorized network access between June 11-29, 2020. Employment records containing PII, government IDs, financial data, credentials, and PHI were accessed. The company engaged forensic experts and law enforcement, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 11, 2020

Begins

Aug 28, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_66c26a46303b63f12020-08-28Verified
Massachusetts State AGbd_70c310db5838d7532020-08-28Verified
California State AGbd_e2bf2611f2f219c72020-08-28Verified
New Hampshire State AGbd_4ba76ce558ac442e2020-08-31 · +3dVerified

Name: PULAU Corporation
norm: pulau

Name: PULAU Corporation
norm: pulau
Industry: Technologyllm

Discovered: —
Breach occurred: Jun 11, 2020 – Jun 29, 2020
Materiality determined: —
Notification sent: Aug 28, 2020
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentialsPHIHealth (basic)
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Coordinated with law enforcement authorities
Initial access: valid_credentials

During the incident: Engaged leading security experts to assist with our investigation
Coordinated with law enforcement authorities on the matter
Put in place additional security measures to help further protect our systems
Arranged to offer identity restoration and credit monitoring services for two years at no cost
Changes made: Put in place additional security measures to help further protect our systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGAug 28 · first

Massachusetts State AGAug 28 · first

California State AGAug 28 · first

Montana State AGAug 28 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/PALAU-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2020
Raw hash: 464dadfb65750529258fefa7a4283d38ba32783e2fd7a97a32cf352e0707fafc

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPULAU Corporation

Victim entityPULAU Corporation

IncidentUnauthorized Access

Stated responseEngaged leading security experts to assist with our investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov