HackingTechnologyTelecom & MediaInformationVulnerability ExploitZero-DayData ExfiltratedTargetedIdentity (basic)LowContained

COX ENTERPRISES, INC.

bd_7369119a392f4428 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 29, 2025

Filed

Nov 25, 2025

To disclose

8 weeks

Affected

7state residents only

Linked

10 filings

Confidence

65%

Full breach record for COX ENTERPRISES, INC. →

Cox Enterprises, Inc. notified Montana residents of a data breach involving Oracle E-Business Suite. Unauthorized access occurred Aug 9-14, 2025 via a zero-day vulnerability. Cox discovered suspicious activity on Sep 29, 2025, and confirmed personal information (names) was involved on Oct 31, 2025. Notices sent Nov 20, 2025. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

discovery → filing · 8 weeks / 57 days

Aug 9, 2025

Begins

Sep 29, 2025

Discovered

Nov 25, 2025

Filed

vs. sector median

11 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_839c9a8c3542409b2025-10-27 · +29dVerified by operator

Regulatory filings (8) · sorted by filing gap

Texas State AGbd_244cea98a033cd5c2025-11-21 · +4dVerified
New Hampshire State AGbd_8766c6dda720b44a2025-11-21 · +4dVerified
Nebraska State AGbd_40c9054d459138182025-11-20 · +5dVerified by operator
Vermont State AGbd_76c8778cb9fa2c6d2025-11-20 · +5dVerified

Show 4 more filings ↓up to 5d gap

Massachusetts State AGbd_969a08a7f00f6f732025-11-20 · +5dVerified by operator
Indiana State AGbd_a35479fbdcf86c9a2025-11-20 · +5dVerified
Maine State AGbd_c14447cb7482b2fd2025-11-20 · +5dVerified
California State AGbd_d243eedeb344b5f22025-11-20 · +5dVerified

Name: COX ENTERPRISES, INC.
norm: cox enterprises
Domain: coxenterprises.com

Name: COX ENTERPRISES, INC.
norm: cox enterprises
Domain: coxenterprises.com
Industry: TechnologyllmTelecom & Mediallm

Discovered: Sep 29, 2025
Breach occurred: Aug 9, 2025 – Aug 14, 2025
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2025
Affected individuals: 7state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: been in contact with law enforcement
Initial access: exploit_public_facing

During the incident: Launched an investigation
Applied Oracle’s security fix as soon as it became available
Brought in cybersecurity experts and data analysts to review our systems and the data that we thought may have been copied and taken
Been in contact with law enforcement
Offering you 12/24 months of free credit monitoring and identity theft protection services through IDX
Changes made: Constantly evaluating and monitoring our security practices and those of the third-party vendors we work with to minimize the risk of any similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Nebraska State AGNov 20 · first

Vermont State AGNov 20 · first

Massachusetts State AGNov 20 · first

Indiana State AGNov 20 · first

Maine State AGNov 20 · first

California State AGNov 20 · first

Texas State AG+1d

New Hampshire State AG+1d

Montana State AG+5d · this page

Pattern: first filing Nov 20 (NE), last Nov 25 (MT) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/01/Consumer-notification-letter-7.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 25, 2025
Raw hash: 71408d4d3eda32e1bef0201f82058f6e02d001795f7c33f3d98f937751c12e38

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityCOX ENTERPRISES, INC.

Victim entityCOX ENTERPRISES, INC.

Incidentdiscovered Sep 29, 2025

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov