iHeartMedia suffers breach that exposed personal data
iHeartMedia, America’s largest owner of radio stations, suffered a breach in December that exposed personal data, including Social Security and passport numbers.
Image by Michael Buckner/Billboard/Getty Images
iHeartMedia, America’s largest owner of radio stations, suffered a breach in December that exposed personal data, including Social Security and passport numbers.
The company told Cybernews via email that it detected the breach that same month and "fully addressed" it within a week, with the investigation concluding on April 11th. It started to inform the affected individuals on April 30th.
iHeartMedia owns more than 870 radio stations in the US and operates the iHeartRadio platform, home to popular podcasts such as its original Dear Chelsea with Chelsea Handler, as well as Anna Faris Is Unqualified and The Ben Shapiro Show.
In a notice letter, the San Antonio, Texas-based company said that all of the files viewed and obtained by an “unauthorized actor” contained names, while some also included:
- Social Security numbers
- Tax identification numbers
- Driver's license numbers
- State identification card numbers
- Passport numbers
- Financial account numbers
- Payment card numbers
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
iHeart said that the exposed files were stored on systems at “a small number” of its local stations.
It did not disclose the total number of affected individuals, though at least three were residents of Maine, where state law requires companies to send data breach notifications.
The letter said at least one Rhode Island resident was affected by the breach, while Maryland, New York, North Carolina, and New Mexico were also listed, though the number of affected individuals in those states was not disclosed.
According to the notification letter, the unauthorized party accessed files between December 24th and December 27th last year.
“As soon as iHeart became aware, it immediately implemented its response protocols, took measures to contain the activity, and launched an investigation,” the company said.
“Additionally, a cybersecurity firm that has assisted other companies in similar situations was engaged, and iHeart notified law enforcement,” it added.
iHeart said it had strengthened its security measures and would offer affected individuals one year of credit monitoring and identity theft protection.
The text has been updated with the comment from iHeart.