AccidentalTechnologyInformationMisconfigurationCustomer Data InvolvedAuthenticationIdentity (basic)MediumContained

Over The Top (OTT)

bd_bc344851e87bc2d9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2022

Filed

May 30, 2023

To disclose

26 weeks

Affected

22,723state residents only

Confidence

68%

Full breach record for Over The Top (OTT) →

Over The Top (OTT) disclosed that a publicly accessible cloud storage bucket containing personal information for 22,723 Washington residents was exposed from October 3 to November 29, 2022. Data included names, addresses, emails, and DOBs. OTT contained the breach, notified the WA AG, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d26 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 57 days

discovery → filing · 26 weeks / 182 days

Oct 3, 2022

Begins

Nov 29, 2022

Discovered

May 30, 2023

Filed

vs. sector median

+7 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed22,723 affectedView incident

Name: David J. Shannon / MDWC & Associates
norm: mdwc & associates

Name: Over The Top (OTT)
norm: over the top ott
Industry: Technologyllm

Discovered: Nov 29, 2022
Breach occurred: Oct 3, 2022 – Nov 29, 2022
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 26, 2023
Affected individuals: 22,723state-resident count only
Data types: Identity (basic)
Data elements: NameDate of birthUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Washington State Office of the Attorney General

During the incident: Shutdown any access to the bucket on its computer system
Installed additional security protocols
Mailed Notification Letters via the United States Postal Service First Class Mail
Offered credit monitoring for one year
Changes made: Implemented enhanced security measures
Confirmed that the computer system vulnerability has been corrected
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(182 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24276.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 30, 2023
Raw hash: c40e3cc079c41d0a0d84f689ae7d3c2c18256ee13c2ad0441b768484f94d7ddd

Reporting entityDavid J. Shannon / MDWC & Associates

Victim entityOver The Top (OTT)

Incidentdiscovered Nov 29, 2022

Stated responseShutdown any access to the bucket on its computer system

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com