National Amusements, CBS and Paramount’s parent company, reported a year-old hack this month affecting 82,128 people. TechCrunch first covered the breach, revealed in a company legal filing with Maine’s Attorney General under a 2005 state digital privacy law. National Amusements hasn’t commented publicly on the intrusion outside of the legal filing, and it isn’t clear if customer (or “only” employee) data was stolen.
Maine’s data breach notification says the hack occurred over a year ago, from December 13 to 15, 2022. It states 82,128 people were affected, 64 of whom were Maine residents. National Amusements’ senior vice president of human resources filed the notice, which may suggest (but not confirm) that it revolved largely or entirely around internal employee data. The filing says the company began notifying customers in writing on December 22, 2023 — 372 days after the breach.
“On or about December 15, 2022, National Amusements became aware of suspicious activity in our computer network,” the notification letter to victims reads. “We immediately took steps to secure our network and minimize any disruption to our operations.”
However, that last sentence contains an inconsistency, as the notice posted by Maine’s Attorney General’s office lists the “date breach discovered” as August 23, 2023. That suggests the company didn’t know about the intrusion until eight months after the incident, hardly qualifying as “immediately” taking steps.
The filing says hackers accessed financial information, including “account number or credit/debit card number (in combination with security code, access code, password or PIN for the account).” National Amusements wrote in Maine’s notice that it’s offering victims 12 months of Experian credit monitoring and identity theft services to customers whose social security numbers were taken.
Engadget contacted National Amusements for confirmation or additional info. We will update this article if we hear back.
National Amusements gained a controlling stake in Paramount and CBS in 2019 following the Viacom-CBS merger. This hack appears separate from one Paramount disclosed in August through Massachusetts’ Attorney General’s Office. The company listed that breach’s date as “between May and June 2023.”
