HackingStolen CredentialsCapture Stored DataCustomer Data InvolvedTargetedPIIIDENTITY_BASICLowActive
UNIVERSAL MUSIC GROUP, INC.
bd_8ec6d91e759f81d6 · schema v1 · pii pii-v1
Full breach record for UNIVERSAL MUSIC GROUP, INC. →Universal Music Group notified New Hampshire AG of a security incident detected in July 2024 involving unauthorized access to a source code storage platform. An unknown third party acquired credentials for other UMG applications and data repositories, potentially accessing PII including birthdates and addresses. Two New Hampshire residents were affected. UMG engaged forensic investigators and data review firms, mailed notices on October 3, 2024, and offered credit monitoring.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_106976700dd702d6Montana State AGfiled 2024-10-03Verified
- bd_aa8098ed749c080cVermont State AGfiled 2024-10-03Verified
- bd_ae3dedf25ecbc39eMaine State AGfiled 2024-10-03Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/universal-music-group-20241003.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 3, 2024
- Raw hash
- 1de42b84428432bc0185ed6a1da85be1d698e3c3f1eff0cdbb85984116eb56a5
Reporting entity
- Name
- UNIVERSAL MUSIC GROUP, INC.norm: universal music
Victim entity
- Name
- UNIVERSAL MUSIC GROUP, INC.norm: universal music
Incident
- Discovered
- Jul 1, 2024
- Materiality determined
- —
- Notification sent
- Oct 3, 2024
- Affected individuals
- 2
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General Consumer Protection Bureau
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 13 weeks(94 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.