MalwareTechnologyRetail & ConsumerInformationRansomwareStolen CredentialsRansom DemandedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCredentialsHighContained

Arbiter Sports, LLC

bd_a5b7dead52d1d8ef · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 14, 2020

Filed

Aug 28, 2020

To disclose

6 weeks

Affected

8,052state residents only

Linked

8 filings

Confidence

64%

Full breach record for Arbiter Sports, LLC →2 incidents on file

Arbiter Sports, LLC notified South Carolina residents of a ransomware incident where unauthorized access led to the exfiltration of a database containing usernames, passwords, names, addresses, DOBs, and SSNs. The attacker demanded payment; Arbiter Sports paid and confirmed file deletion. Affected individuals were offered one year of Experian IdentityWorks. Notification sent August 21, 2020.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 13 days

discovery → filing · 6 weeks / 45 days

Jul 1, 2020

Begins

Jul 14, 2020

Discovered

Aug 28, 2020

Filed

vs. sector median

12 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_68071428e8804f102020-08-25 · +3dVerified
Delaware State AGbd_2ad808a83d601c542020-08-24 · +4dVerified
Hawaii State AGbd_50cde91aa69547482020-08-24 · +4dVerified
Montana State AGbd_914219091439dcf42020-08-24 · +4dCandidate

Show 3 more filings ↓up to 4d gap

Oregon State AGbd_9823a3720e9064cc2020-08-24 · +4dVerified
Massachusetts State AGbd_b7853a6a391d8d242020-08-24 · +4dVerified
Washington State AGbd_d82a775b363f09ac2020-08-24 · +4dVerified

Name: Arbiter Sports, LLC
norm: arbiter sports
Domain: arbiter.io

Name: Arbiter Sports, LLC
norm: arbiter sports
Domain: arbiter.io
Industry: TechnologyllmRetail & Consumerllm

Discovered: Jul 14, 2020
Breach occurred: Jul 1, 2020 – Jul 15, 2020
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 21, 2020
Affected individuals: 8,052state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement and are supporting their investigation
Initial access: valid_credentials

During the incident: Took measures to stop the access
Launched an investigation
Engaged a security firm
Reached an agreement and obtained confirmation that the unauthorized party deleted the files
Notified law enforcement and are supporting their investigation
Changes made: Implemented additional measures and changes to enhance the security of the network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Delaware State AGAug 24 · first

Hawaii State AGAug 24 · first

Montana State AGAug 24 · first

Oregon State AGAug 24 · first

Massachusetts State AGAug 24 · first

Washington State AGAug 24 · first

New Hampshire State AG+1d

South Carolina State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ArbiterSports.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2020
Raw hash: 20a0a6f28908cff53ef13430ca28418a5684dc3e2313396f9cbb8b6390cc48ba

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityArbiter Sports, LLC

Victim entityArbiter Sports, LLC

Incidentdiscovered Jul 14, 2020

Stated responseTook measures to stop the access

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov