HackingTransportation & LogisticsTransportationStolen CredentialsCustomer Data InvolvedAuthenticationCredentialsPIIMediumContained

Amtrak

bd_f2ad5e3d1d8ef141 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 24, 2020

Filed

Nov 4, 2020

To disclose

15 weeks

Affected

1,208state residents only

Linked

5 filings

Confidence

68%

Full breach record for Amtrak →4 incidents on file

Amtrak notified the Washington AG of unauthorized access to certain Amtrak Guest Rewards accounts on July 24, 2020. The incident compromised usernames, passwords, and associated PII (mailing/email addresses) for 1,208 Washington residents. No financial data or SSNs were involved. Amtrak reset passwords, blocked access, engaged forensic experts, and offered one year of Experian IdentityWorks to affected individuals. Notifications were sent November 5, 2020.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d15 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 15 weeks / 103 days

Jul 24, 2020

Discovered

Nov 4, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_3b6e36d60242cb512020-11-04Candidate
California State AGbd_970e71f598be3db92020-11-04Verified
Montana State AGbd_00fb63d5aaac710b2020-11-05 · +1dVerified
New Hampshire State AGbd_3dca81f577463bc32020-11-09 · +5dVerified

Name: Amtrak
norm: amtrak
Domain: amtrak.com

Name: Amtrak
norm: amtrak
Domain: amtrak.com
Industry: Transportation & Logisticsllm

Discovered: Jul 24, 2020
Materiality determined: —
Notification sent: Nov 5, 2020
Affected individuals: 1,208state-resident count only
Data types: AuthenticationCredentialsPII
Data elements: Username + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Washington Office of Attorney General
Initial access: valid_credentials

During the incident: Locking each affected account until the password was reset
Resetting the passwords for potentially affected accounts
Geo blocking account access
Engaged outside cybersecurity experts to confirm that the incident was contained
Implemented additional safeguards to protect consumers
Changes made: Implemented additional safeguards to protect consumers
Offering affected individuals a complimentary one-year membership of Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGNov 4 · first

California State AGNov 4 · first

Washington State AGNov 4 · first · this page

Montana State AG+1d

New Hampshire State AG+5d

Pattern: first filing Nov 4 (ME), last Nov 9 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10354.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 4, 2020
Raw hash: c71e48e17c61f26b7ecbf0bcf5b96ea3f9a96abc8590c182136746baeddfc693

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAmtrak

Victim entityAmtrak

Incidentdiscovered Jul 24, 2020

Stated responseLocking each affected account until the password was reset

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com