HackingTechnologyRetail & ConsumerInformationVulnerability ExploitStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Government IDCredentialsMediumActive

Churchill Downs Technology Initiatives Company

bd_8cf541b7ce769ea5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 3, 2012

Filed

Sep 4, 2012

To disclose

5 weeks

Affected

370state residents only

Linked

2 filings

Confidence

66%

Full breach record for Churchill Downs Technology Initiatives Company →2 incidents on file

Churchill Downs Technology Initiatives Company (dba TwinSpires.com) notified the NH AG of a data breach discovered on August 3, 2012. Unauthorized access exposed names, emails, DOBs, and hashed SSNs for approximately 370 NH residents. Notices mailed September 4, 2012. Response included forensic investigation, legal counsel, credit bureau notification, and 1-year Experian identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 32 days

Aug 3, 2012

Discovered

Sep 4, 2012

Filed

vs. sector median

14 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_d46b4a2f3d94e6b12012-09-04Candidate

Name: Churchill Downs Inc
norm: churchill downs
Domain: churchilldownsincorporated.com

Name: Churchill Downs Technology Initiatives Company
norm: churchill downs technology initiatives
Industry: TechnologyllmRetail & Consumerllm

Discovered: Aug 3, 2012
Materiality determined: —
Notification sent: Sep 4, 2012
Affected individuals: 370state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Attorney General Michael A. Delaney
Initial access: exploit_public_facing

During the incident: Retained Nelson, Levine, de Luca & Hamilton, LLC, breach notification legal counsel
Retained forensic computer analysts Kivu Consulting, Inc., to assist with its investigation
Notified the three major credit reporting agencies of this incident
Offered free special identity protection services to those impacted
Changes made: Retained experts to assist with existing and ongoing security efforts
Arranged with Experian to provide identity protection services that include credit monitoring of all three credit bureaus for a year at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGSep 4 · first

New Hampshire State AGSep 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/twinspires-20120904.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2012
Raw hash: ee0bef3a47fbfe09412bbd46a9e07a193c1a4ad3cc96facda0d512f40fb70637

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityChurchill Downs Inc

Victim entityChurchill Downs Technology Initiatives Company

Incidentdiscovered Aug 3, 2012

Stated responseRetained Nelson, Levine, de Luca & Hamilton, LLC, breach notification legal counsel

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov