HackingRetailCustomer Data InvolvedData ExfiltratedPCIFinancial accountFinancial credentialsIdentity (basic)MediumContained

Amateur Athletic Union

bd_ef8c672acb9b8d2d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 2, 2019

Filed

Sep 13, 2019

To disclose

6 weeks

Affected

38,925state residents only

Linked

9 filings

Confidence

66%

Full breach record for Amateur Athletic Union →

Amateur Athletic Union (AAU) identified malicious code on its website checkout page on August 2, 2019, which could have captured payment card information (cardholder name, address, credit card number, expiration date, and CVV) entered between October 1, 2018, and July 2, 2019. The code was removed, and forensic investigators were engaged. Approximately 38,925 California residents were affected. AAU notified affected individuals and regulators, and implemented enhanced security measures.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 2, 2019 → Notified Sep 13, 201942d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 305 days

discovery → filing · 6 weeks / 42 days

Oct 1, 2018

Begins

Aug 2, 2019

Discovered

Sep 13, 2019

Filed

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Delaware State AGbd_188946594fb109282019-09-13Verified
Hawaii State AGbd_6abca2ac98691b142019-09-13Verified
Oregon State AGbd_7dfeedd60232f38e2019-09-13Candidate
Washington State AGbd_a145c79fea7b2b152019-09-13Verified

Show 4 more filings ↓up to 4d gap

Montana State AGbd_b07fe0428d117bac2019-09-13Verified by operator
Massachusetts State AGbd_d59377d0feb320c02019-09-13Verified
New Hampshire State AGbd_0fc905e5def94bb72019-09-17 · +4dVerified
South Carolina State AGbd_6d9e5de3b9f26d6b2019-09-17 · +4dVerified

Name: Amateur Athletic Union
norm: amateur athletic union
Domain: play.aausports.org

Name: Amateur Athletic Union
norm: amateur athletic union
Domain: play.aausports.org

Discovered: Aug 2, 2019
Breach occurred: Oct 1, 2018 – Jul 2, 2019
Undetected for: 305 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 13, 2019
Affected individuals: 38,925state-resident count only
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1056 Input Capture
Threat actor: External
Regulator citations: Notified required state regulatorsNotified consumer reporting agencies

During the incident: Engaged third party forensic investigators
Removed malicious code from the site
Reviewed transaction records to determine the identities of its members whose payment card information may be impacted
Notified required state regulators and consumer reporting agencies about this incident
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one's credit file
Changes made: Conducted a thorough website review
Implementing enhanced security measures to reduce the risk of a similar incident
Working to implement additional safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: CA 60-day OK · 42d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 2, 2019
→ Notified: Sep 13, 2019
42d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 2, 2019 → Notified: Sep 13, 2019	42d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Delaware State AGSep 13 · first

Hawaii State AGSep 13 · first

Oregon State AGSep 13 · first

Washington State AGSep 13 · first

Montana State AGSep 13 · first

Massachusetts State AGSep 13 · first

California State AGSep 13 · first · this page

New Hampshire State AG+4d

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-150546
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 13, 2019
Raw hash: 0eb54e7569a39d5a1a9a5965ad283d989c75d9a66878839a65fc98bf6e225779

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityAmateur Athletic Union

Victim entityAmateur Athletic Union

Incidentdiscovered Aug 2, 2019

Stated responseEngaged third party forensic investigators

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov