National Amusements Data Breach: A Year of Silence Followed by Scant Details

National Amusements, the media behemoth controlling Paramount, CBS, and a vast network of theaters across the United States, has been embroiled in a data breach scandal. The incident, which occurred in late 2022, has raised serious questions about the company’s cybersecurity protocols and its transparency in handling sensitive user data. A full year elapsed before National Amusements notified the tens of thousands of affected individuals, a delay that has fueled criticism and concern.

The breach, first reported by TechCrunch, was disclosed to the Maine Attorney General, as mandated by state law. The notification revealed that 82,128 individuals were impacted, although the precise breakdown between customers and National Amusements employees remains unclear. In a letter sent to those affected, the company stated that an "unauthorized individual" gained access to the company network on December 13, 2022, with the breach being detected two days later.

The company claims to have promptly engaged a third-party cybersecurity firm to conduct a thorough investigation. However, the investigation’s completion and the subsequent confirmation of the data breach weren’t established until August 23 of this year. This timeline suggests a considerable delay in identifying the scope and nature of the compromised data.

In response to the breach, National Amusements is offering affected individuals free credit monitoring services through Experian for a limited period. This measure aims to mitigate potential financial risks associated with the compromised data.

The delay in disclosing the breach has been particularly scrutinized. Under Maine law, companies are obligated to report data breaches involving personal information and to conduct a comprehensive investigation, submitting the findings to the state. The year-long lag between the breach and the notification has sparked outrage and accusations of negligence.

Gizmodo reached out to National Amusements for comment, seeking clarification on the reasons behind the delayed disclosure. However, the company has remained largely silent, fueling further speculation and distrust. The company, in a statement to Deadline, stated that it has found no indication of identity theft or fraud related to the hack and emphasized its commitment to "information security." This statement does little to alleviate concerns about the company’s handling of the incident.

Adding to the complexity, Paramount Global itself acknowledged a separate security breach that occurred between May and June of this year. The company stated that an unauthorized party gained access to its systems and obtained users’ personal information. The extent to which this breach impacted Paramount+ customers remains unclear, further compounding the company’s security woes.

These security lapses come at a particularly challenging time for Paramount. The company has recently announced a rebranding of its streaming services, merging Paramount+ with Showtime. Additionally, it is exploring potential bundling options with Apple TV+ to expand its subscriber base.

However, Paramount+ has also been undergoing a period of content reduction, cutting the number of movies available for streaming by half. The company’s financial performance and strategic direction have been subjects of intense scrutiny.

Adding to the uncertainty, Shari Redstone, the head of the family that acquired Paramount Pictures in 1994, is reportedly considering selling her family’s stake in National Amusements. Among the potential bidders is Warner Bros. Discovery, a media conglomerate whose recent merger has been widely criticized as a financial disaster. The prospect of another major media acquisition has been met with skepticism and concern about further consolidation of power within the entertainment industry.

The data breach at National Amusements and the subsequent disclosure delays have highlighted critical issues regarding data security and corporate responsibility. The company’s failure to promptly notify affected individuals has damaged its reputation and eroded trust among its customers and stakeholders. The incident serves as a stark reminder of the importance of robust cybersecurity measures and transparent communication in the digital age.

The company’s silence has created an information vacuum that has been filled with speculation and negative publicity. Without clear and comprehensive communication from National Amusements, it is difficult to assess the true extent of the damage and the measures being taken to prevent future breaches.

The company needs to provide greater transparency regarding:

• The specific types of personal information that were compromised in the breach.
• The measures that National Amusements is taking to prevent similar incidents in the future.
• The support and resources being offered to affected individuals to help them mitigate potential financial risks.

The data breach at National Amusements underscores the growing threat of cyberattacks against organizations holding sensitive data. It is essential for companies to invest in robust cybersecurity defenses, to monitor their networks for suspicious activity, and to have a clear and comprehensive plan for responding to data breaches.

Moreover, companies must prioritize transparency and communication when data breaches occur. Promptly notifying affected individuals and providing clear and accurate information about the incident is crucial for maintaining trust and mitigating potential damage.

The National Amusements data breach serves as a cautionary tale for all organizations. The company’s handling of the incident has demonstrated the potential consequences of failing to prioritize data security and transparency. In an era of increasing cyber threats, companies must take proactive measures to protect their data and to communicate effectively with stakeholders when breaches occur.