HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
AMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC.
bd_f6e24127e99bb226 · schema v1 · pii pii-v1
Full breach record for AMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC. →American Express Travel Related Services Company, Inc. disclosed a data breach involving its third-party vendor, Expedia, affecting the Orbitz travel booking platform. The incident, occurring between July 5 and July 9, 2018, exposed customer names, payment card information, email, and physical/billing addresses. American Express notified affected individuals on July 31, 2018, offering two years of Experian IdentityWorks. The attack targeted the vendor's platform, not American Express's core systems.
California clockDiscovered Jul 23, 2018 → Notified Jul 31, 20188d ✓ CA 60-day OK10 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-138513
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 2, 2018
- Raw hash
- ada9eb6b71097b641a6da928a30e9195f26628b20c7d8ce24361304868524b12
Reporting entity
- Name
- AMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC.norm: american express travel related
Victim entity
- Name
- AMERICAN EXPRESS TRAVEL RELATED SERVICES COMPANY, INC.norm: american express travel related
Incident
- Discovered
- Jul 23, 2018
- Materiality determined
- —
- Notification sent
- Jul 31, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Third party
- via Expedia
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 days(10 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 8d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 23, 2018→ Notified: Jul 31, 20188d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.