HackingTelecom & MediaInformationStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDCredentialsMediumContained

Entercom Communications Corp.

bd_8a654057dd93acd5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 1, 2019

Filed

Mar 9, 2020

To disclose

27 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Entercom Communications Corp. →3 incidents on file

Entercom Communications Corp. disclosed a cyber-attack where an unauthorized actor accessed database backup files in third-party cloud hosting services for approximately three hours on August 4, 2019. The company became aware of the incident in September 2019. Affected data included names, usernames, passwords, and for some listeners, Social Security numbers and driver's license numbers. Entercom implemented MFA, password rotations, and enhanced auditing. Credit monitoring was offered to affected individuals with SSN/DL exposure.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 1, 2019 → Notified Mar 6, 2020187d ✗ CA 60-day late27 weeks discovery → filing

Incident timeline

undetected · 28 days

discovery → filing · 27 weeks / 190 days

Aug 4, 2019

Begins

Sep 1, 2019

Discovered

Mar 9, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Illinois State AGbd_b3655f5455377b722020-01-01 · +68dCandidate

Name: Entercom Communications Corp.
norm: entercom communications

Name: Entercom Communications Corp.
norm: entercom communications
Industry: Telecom & Mediallm

Discovered: Sep 1, 2019
Breach occurred: Aug 4, 2019 – Aug 4, 2019
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 6, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notifying regulatory authorities, as required
Third party: via Third-party cloud hosting services

During the incident: Began an investigation with assistance from outside data privacy and computer forensics specialists
Implemented password rotations
Enabled multifactor authentication and stronger password policies for all cloud services
Enhanced and broadened auditing based on best practices advised by third party experts
Configured alerts for certain behaviors using the relevant platforms
Providing additional training to staff on data security
Notifying regulatory authorities, as required
Changes made: Implemented password rotations
Enabled multifactor authentication and stronger password policies for all cloud services
Enhanced and broadened auditing based on best practices advised by third party experts
Configured alerts for certain behaviors using the relevant platforms
Providing additional training to staff on data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(190 days from discovery to filing)
Compliance flags: CA 60-day late · 187d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 1, 2019
→ Notified: Mar 6, 2020
187d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 1, 2019 → Notified: Mar 6, 2020	187d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+68d · this page

Pattern: first filing Jan 1 (IL), last Mar 9 (CA) — a 68-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-188077
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 9, 2020
Raw hash: a186a9758ab836040ef17965c9c55a67d0761d2cb155c69f3d4e734512f4ef82

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEntercom Communications Corp.

Victim entityEntercom Communications Corp.

Incidentdiscovered Sep 1, 2019

Stated responseBegan an investigation with assistance from outside data privacy and computer forensics specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov