HackingTechnologyInformationVulnerability ExploitCapture Stored DataZero-DayData ExfiltratedTargetedGovernment IDIdentity (basic)MediumContained

ARISTOCRAT TECHNOLOGIES, INC.

bd_f6cfde1f457ae0a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2023

Filed

Sep 20, 2023

To disclose

16 weeks

Affected

978state residents only

Linked

7 filings

Confidence

69%

Full breach record for ARISTOCRAT TECHNOLOGIES, INC. →

Aristocrat Technologies disclosed a cyber incident where a criminal group exploited a previously unknown vulnerability in MOVEit Transfer software between May 29-31, 2023. The company discovered the incident on June 1, 2023. Personal data including SSNs and government IDs were exfiltrated. 978 Washington residents were notified. Remediation included patching the vulnerability and offering credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 16 weeks / 111 days

May 29, 2023

Begins

Jun 1, 2023

Discovered

Sep 20, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_e8c722d5edffc20e2023-07-26 · +56dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_220882196d8d5ed72023-09-20Verified by operator
Maine State AGbd_435e1eee74ecf8a32023-09-20Candidate
Montana State AGbd_502db1048f27713a2023-09-20Verified by operator
New Hampshire State AGbd_52c2b0ce02f743cc2023-09-21 · +1dVerified

Show 1 more filing ↓up to 1d gap

Indiana State AGbd_d625029d02653b4a2023-09-21 · +1dVerified

Name: ARISTOCRAT TECHNOLOGIES, INC.
norm: aristocrat technologies
Domain: aristocrat.com

Name: ARISTOCRAT TECHNOLOGIES, INC.
norm: aristocrat technologies
Domain: aristocrat.com
Industry: Technologyllm

Discovered: Jun 1, 2023
Breach occurred: May 29, 2023 – May 31, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 21, 2023
Affected individuals: 978state-resident count only
Data types: Government IDIdentity (basic)
Data elements: NameSocial Security numberDriver's licence numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcementNotified relevant supervisory authorities and regulators
Initial access: exploit_public_facing

During the incident: Removed the impacted server from the network
Launched an investigation
Fixed the relevant software vulnerability
Notified law enforcement
Offering 24 months of complimentary credit monitoring and identity theft protection services
Changes made: Fixed the relevant software vulnerability
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(111 days from discovery to filing)
Compliance flags: WA AG >90dLeak >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGSep 20 · first

Maine State AGSep 20 · first

Montana State AGSep 20 · first

Washington State AGSep 20 · first · this page

New Hampshire State AG+1d

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26540.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2023
Raw hash: 171324e6d359fa51c7a58395310a898cb07d19566d9b9b0a5ff6054c488abf81

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityARISTOCRAT TECHNOLOGIES, INC.

Victim entityARISTOCRAT TECHNOLOGIES, INC.

Incidentdiscovered Jun 1, 2023

Stated responseRemoved the impacted server from the network

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com