DisclosureLens
Social EngineeringTransportation & LogisticsTransportationPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDHealth (basic)MediumContained

American Airlines Group Inc.

bd_9384cc6b705d15da · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2022

Filed

Sep 16, 2022

To disclose

11 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%
Full breach record for American Airlines Group Inc.6 incidents on file

American Airlines, Inc. notified Montana residents that in July 2022, unauthorized actors compromised the email accounts of a limited number of team members via phishing. The incident may have exposed personal information including names, DOBs, driver's license numbers, passport numbers, and medical information. No evidence of misuse was found. The company secured accounts, engaged forensic investigators, and offered two years of Experian IdentityWorks.

Incident timeline

discovery → filing · 11 weeks / 77 days

Jul 1, 2022

Discovered

Sep 16, 2022

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Maine State AGSep 16 · first
Indiana State AGSep 16 · first
Montana State AGSep 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.