UnknownFinancial accountFinancial credentialsLow

Expedia Group, Inc.

bd_b1b6f720de0c805a · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 14, 2022

Filed

Mar 2, 2022

To disclose

16 days

Affected

3scope not determined

Linked

3 filings

Confidence

50%

Full breach record for Expedia Group, Inc. →

On March 24, 2021, Expedia Group, Inc. experienced a security breach that was discovered on February 14, 2022. The breach affected 3 Maine residents and involved the compromise of financial account numbers or credit/debit card numbers, along with their corresponding security codes, access codes, passwords, or PINs. The company provided 12 months of identity theft protection services through Expedia IdentityWorks to those affected.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 14, 2022 → Filed with AG Mar 2, 202216d ✓ ME AG ≤30d16 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 327 days

discovery → filing · 16 days

Mar 24, 2021

Begins

Feb 14, 2022

Discovered

Mar 2, 2022

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_5d0bf85e55a02ab52022-03-02Verified
Indiana State AGbd_b3cbd3de7bb95e4b2022-03-02Verified

Name: Expedia Group, Inc.
norm: expedia group
Domain: expedia.com

Name: Expedia Group, Inc.
norm: expedia group
Domain: expedia.com

Discovered: Feb 14, 2022
Breach occurred: Mar 24, 2021
Undetected for: 327 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 2, 2022
Affected individuals: 3scope not determined
Data types: Financial accountFinancial credentials
Data elements: Financial account number
Attack vector: Unknown

Changes made: Offered 12 months of identity theft protection services through Expedia IdentityWorks.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: ME AG ≤30d · 16d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 14, 2022
→ Filed with AG: Mar 2, 2022
16d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 14, 2022 → Filed with AG: Mar 2, 2022	16d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 2 · first

Indiana State AGMar 2 · first

Maine State AGMar 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/9a23a6fa-b5d3-4521-a318-7f507985e950.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2022
Raw hash: a4cb6ab863844e141dc9afece138d6234d4fabcbaa0c390384b0f96fef216721

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityExpedia Group, Inc.

Victim entityExpedia Group, Inc.

Incidentdiscovered Feb 14, 2022

Stated responseOffered 12 months of identity theft protection services through Expedia IdentityWorks.

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov