HackingInformationEmployee Data InvolvedData ExfiltratedEmploymentIdentity (basic)Government IDFinancial accountCredentialsHealth (basic)MediumContained

PULAU Corporation

bd_e2bf2611f2f219c7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 28, 2020

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for PULAU Corporation →

PULAU Corporation notified individuals of unauthorized access to its network between June 11 and June 29, 2020. An external party acquired employment-related records containing personal information including names, contact info, dates of birth, government-issued IDs (SSN, passport, driver's license), financial account info, online credentials, and health-related information. The company engaged security experts, coordinated with law enforcement, and secured systems. Affected individuals were offered two years of identity restoration and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 11, 2020

Begins

Aug 28, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_647fb8ff9a8c914b2020-08-28Candidate
Indiana State AGbd_66c26a46303b63f12020-08-28Verified
Massachusetts State AGbd_70c310db5838d7532020-08-28Verified
New Hampshire State AGbd_4ba76ce558ac442e2020-08-31 · +3dVerified

Name: PULAU Corporation
norm: pulau

Name: PULAU Corporation
norm: pulau

Discovered: —
Breach occurred: Jun 11, 2020 – Jun 29, 2020
Materiality determined: —
Notification sent: Aug 28, 2020
Affected individuals: Not disclosed
Data types: EmploymentIdentity (basic)Government IDFinancial accountCredentialsHealth (basic)
Data elements: Date of birth
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Coordinated with law enforcement authorities

During the incident: Engaged leading security experts to assist with our investigation
Coordinated with law enforcement authorities on the matter
Secure our systems
Put in place additional security measures to help further protect our systems
Changes made: Offered identity restoration and credit monitoring services for two years at no cost
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGAug 28 · first

Indiana State AGAug 28 · first

Massachusetts State AGAug 28 · first

California State AGAug 28 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193554
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2020
Raw hash: 0a24199b8a198714985a1f47625c52f10364c2219be4fd7234ddc58b3cbebcf6

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPULAU Corporation

Victim entityPULAU Corporation

IncidentUnknown

Stated responseEngaged leading security experts to assist with our investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov