Social EngineeringTechnologyInformationPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDCredentialsMediumContained

Xperi Corporation

bd_b53ad13bca41c481 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 31, 2019

To disclose

—

Affected

1state residents only

Linked

3 filings

Confidence

66%

Xperi Corporation (including subsidiary Tessera Technologies) notified Montana residents of a phishing incident where unauthorized parties accessed employee email accounts between March 11-15, 2019. Personal information including names, SSNs, and government IDs may have been exposed. Xperi secured accounts, engaged forensic experts, reset passwords, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 11, 2019

Begins

May 31, 2019

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_5ac14ccf2c5f7e5f2019-06-05 · +5dVerified
New Hampshire State AGbd_20e372850ebb9f572019-06-06 · +6dVerified

Name: Xperi Corporation
norm: xperi
Domain: xperi.com

Name: Xperi Corporation
norm: xperi
Domain: xperi.com
Industry: Technologyllm

Discovered: —
Breach occurred: Mar 11, 2019 – Mar 15, 2019
Materiality determined: —
Notification sent: May 31, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Secured the relevant Xperi email accounts
Engaged a third-party expert to assist in our investigation
Resetting the relevant Xperi accounts' passwords
Monitoring for similar phishing campaigns
Offered identity protection and credit monitoring services for 2 years
Changes made: Put in place additional security measures to help further protect against phishing attempts
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGMay 31 · first · this page

Massachusetts State AG+5d

New Hampshire State AG+6d

Pattern: first filing May 31 (MT), last Jun 6 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/BreachNotificationDetails-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 31, 2019
Raw hash: aa30d68b673f3871c6e099cd39042e3ac97dd886f2437ea34d4ae070301e7c8f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityXperi Corporation

Victim entityXperi Corporation

IncidentPhishing

Stated responseSecured the relevant Xperi email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov