Social EngineeringTelecom & MediaInformationPhishingTargetedCredentialsPIILowResolved

CenturyLink

bd_e180ab1f5bf8d156 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 17, 2022

Filed

Apr 21, 2022

To disclose

5 weeks

Affected

1state residents only

Confidence

66%

Full breach record for CenturyLink →2 incidents on file

CenturyLink notified Montana residents of a privacy incident where unauthorized password resets occurred via phishing. Bad actors used info from unrelated malicious websites to reset email passwords. CenturyLink reset accounts, added restrictions, trained agents, and offered 12 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 35 days

Mar 17, 2022

Discovered

Apr 21, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: CenturyLink
norm: centurylink

Name: CenturyLink
norm: centurylink
Industry: Telecom & Mediallm

Discovered: Mar 17, 2022
Materiality determined: —
Notification sent: Apr 14, 2021
Affected individuals: 1state-resident count only
Data types: CredentialsPII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Engaged a team of security, privacy, operations, and legal personnel to understand the facts
Impacted email accounts were promptly reset
Added additional restrictions to the process for email password changes
Conducted agent training regarding the same to minimize the risk of reoccurrence
Offering a complimentary 12-month membership of Experian’s IdentityWorks
Changes made: Added additional restrictions to the process for email password changes
Conducted agent training regarding the same to minimize the risk of reoccurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-316.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2022
Raw hash: 25870aecc7a2a04177230f71e06e30e9102aa282b992a0c75b5c6aee05c8530d

Reporting entityCenturyLink

Victim entityCenturyLink

Incidentdiscovered Mar 17, 2022

Stated responseEngaged a team of security, privacy, operations, and legal personnel to understand the facts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov