MisuseProfessional ServicesProfessional ServicesPrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDMediumContained

All American Entertainment

bd_bfb8f15a4e8889f3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 25, 2019

Filed

Sep 24, 2019

To disclose

30 weeks

Affected

4state residents only

Confidence

66%

Full breach record for All American Entertainment →

All American Entertainment notified Montana residents of a data breach involving unauthorized access by a former employee. The incident, occurring around Feb 10, 2019 and discovered Feb 25, 2019, exposed names, addresses, and SSNs. AAE reported to the FBI, removed the breach path, and implemented MFA.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 30 weeks / 211 days

Feb 10, 2019

Begins

Feb 25, 2019

Discovered

Sep 24, 2019

Filed

vs. sector median

+11 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4 affectedView incident

Name: All American Entertainment
norm: all american entertainment

Name: All American Entertainment
norm: all american entertainment
Industry: Professional Servicesllm

Discovered: Feb 25, 2019
Breach occurred: Feb 10, 2019
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: AAE promptly reported the breach of security to the Federal Bureau of Investigation and is cooperating with law enforcement in the investigation.
Initial access: insider_action

During the incident: AAE promptly reported the breach of security to the Federal Bureau of Investigation and is cooperating with law enforcement in the investigation.
AAE immediately removed the breach path after the attack was discovered.
AAE conducted a thorough investigation, which did not reveal any publication or dissemination of your personal information as a result of this incident.
AAE’s employee authentication system was replaced with an entirely new system featuring multi-factor authentication, a gold-standard in the industry.
AAE implemented additional security measures to prevent a reoccurrence and to protect the privacy of our valued clients and talent.
AAE sought and received a permanent injunction which prohibits the release of this information.
AAE continues to conduct thorough reviews of its computer systems and records.
Changes made: AAE’s employee authentication system was replaced with an entirely new system featuring multi-factor authentication.
AAE implemented additional security measures to prevent a reoccurrence.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-2.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 24, 2019
Raw hash: 6c8ee7a7a341a317df85c5736266bd7f671dcfe949888686bc84740c6c14d12b

Reporting entityAll American Entertainment

Victim entityAll American Entertainment

Incidentdiscovered Feb 25, 2019

Stated responseAAE promptly reported the breach of security to the Federal Bureau of Investigation and is cooperating with law enforcement in the investigation.

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov