DisclosureLens
HackingTransportation & LogisticsTransportationStolen CredentialsCustomer Data InvolvedCredentialsIdentity (basic)LowResolved

National Railroad Corporation

bd_970e71f598be3db9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 24, 2020

Filed

Nov 4, 2020

To disclose

15 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

National Railroad Corporation (Amtrak) detected unauthorized access to Amtrak Guest Rewards accounts on July 24, 2020. Compromised usernames and passwords were used to access accounts, potentially exposing personal information. No financial data or SSNs were compromised. The company reset passwords, implemented safeguards, and offered one year of Experian IdentityWorks. The incident is resolved.

California clockDiscovered Jul 24, 2020 → Notified Nov 5, 2020104d ✗ CA 60-day late15 weeks discovery → filing

Incident timeline

discovery → filing · 15 weeks / 103 days

Jul 24, 2020

Discovered

Nov 4, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Maine State AGNov 4 · first
Washington State AGNov 4 · first
California State AGNov 4 · first · this page
Montana State AG+1d
New Hampshire State AG+5d

Pattern: first filing Nov 4 (ME), last Nov 9 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.