MisuseTechnologyInformationPrivilege AbuseEmployee Data InvolvedPIIIdentity (basic)Financial accountLowContained

Norton LifeLock

bd_7ac8b10f10ad224b · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 1, 2020

Filed

May 18, 2020

To disclose

7 weeks

Affected

1state residents only

Linked

3 filings

Confidence

67%

Full breach record for Norton LifeLock →

NortonLifeLock Inc. notified Montana residents that a customer care call center agent accessed their personal information in violation of company policy on or about an unspecified date in early 2020. The agent was terminated. Affected data included personal and financial account information. NortonLifeLock offered a free year of Norton 360 Ultimate Plus.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 47 days

Apr 1, 2020

Discovered

May 18, 2020

Filed

vs. sector median

12 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_05d6669b3f6426342020-05-18Verified
Indiana State AGbd_27ff65c099419c892020-05-19 · +1dVerified

Name: Norton LifeLock
norm: norton lifelock
Domain: nortonlifelock.com

Name: Norton LifeLock
norm: norton lifelock
Domain: nortonlifelock.com
Industry: Technologyllm

Discovered: Apr 1, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: The agents have been terminated
No longer have access to our systems
Working with the customer care vendor to determine whether law enforcement can begin a criminal investigation
Changes made: Offering Norton 360 with Ultimate Plus with one (1) year subscription at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMay 18 · first

Montana State AGMay 18 · first · this page

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-172.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 18, 2020
Raw hash: 6a77f8cc3a2f707534f00069fec986a71848d7158d324b696184dea2c660e97b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNorton LifeLock

Victim entityNorton LifeLock

Incidentdiscovered Apr 1, 2020

Stated responseThe agents have been terminated

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov