HackingOtherTargetedIdentity (basic)LowContained

Detroit Symphony Orchestra

bd_919f3f213ee92ff0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 27, 2023

Filed

Apr 1, 2024

To disclose

27 weeks

Affected

2state residents only

Linked

8 filings

Confidence

64%

Full breach record for Detroit Symphony Orchestra →

Detroit Symphony Orchestra notified Montana residents of a data security incident. Unauthorized access occurred between Sept 19-27, 2023. The DSO discovered unusual activity on Sept 27, 2023. Personal information (names) was accessed. The DSO engaged cybersecurity experts, implemented security features, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 27 weeks / 187 days

Sep 19, 2023

Begins

Sep 27, 2023

Discovered

Apr 1, 2024

Filed

vs. sector median

+19 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitesnatchbd_ca38a94d8a0d7c0c2023-11-01 · +152dVerified by operator
Leak Sitedispossessorbd_a8f30121c1ab9f032023-09-24 · +190dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_34fc68c84112c0752024-04-01Verified
Vermont State AGbd_9d8c8188ac7132152024-04-01Verified
New Hampshire State AGbd_adf7430409ccfd8b2024-04-01Verified
Indiana State AGbd_b634aa9051f7fd402024-04-01Verified

Show 1 more filing ↓

Maine State AGbd_f7448b52c6a737612024-04-01Verified by operator

Name: Detroit Symphony Orchestra
norm: detroit symphony orchestra
Domain: dso.org

Name: Detroit Symphony Orchestra
norm: detroit symphony orchestra
Domain: dso.org
Industry: Otherllm

Discovered: Sep 27, 2023
Breach occurred: Sep 19, 2023 – Sep 27, 2023
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2024
Affected individuals: 2state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Engaged leading cybersecurity experts to assist with an investigation
Implemented additional security features to reduce the risk of a similar incident occurring in the future
Offering complimentary credit monitoring and identity theft protection services by Cyberscout through Identity Force
Changes made: Implemented additional security features to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(187 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGApr 1 · first

Vermont State AGApr 1 · first

New Hampshire State AGApr 1 · first

Indiana State AGApr 1 · first

Maine State AGApr 1 · first

Montana State AGApr 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1256.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 1, 2024
Raw hash: 148cd72cc41f1e200b087e1475e4d6acd2adfdc73aa22c0b54e5b01e9ce85b6c

Linked disclosures

Ransomware claims (2)

Regulatory filings (5) · sorted by filing gap

Reporting entityDetroit Symphony Orchestra

Victim entityDetroit Symphony Orchestra

Incidentdiscovered Sep 27, 2023

Stated responseEngaged leading cybersecurity experts to assist with an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov