The Maine Office of the Attorney General disclosed a **data breach** affecting **CenturyLink Communications** between **August 20 and August 31, 2020**. The incident stemmed from a **sophisticated password-guessing attack** targeting the **MyCenturyLink customer portal**, compromising **1,942 accounts**. Exposed data included **usernames, email addresses, full names (first and last), service addresses, billing addresses, and related account details**. While no financial or highly sensitive information (e.g., Social Security numbers, payment card data) was confirmed stolen, the breach risked **unauthorized access to personal and account-specific information**, potentially enabling **phishing, identity fraud, or further targeted attacks**. CenturyLink responded by **issuing written notifications to affected customers between September 21–25, 2020**, though the delay between discovery and disclosure raised concerns about proactive mitigation. The attack highlighted vulnerabilities in **authentication mechanisms**, emphasizing the need for stronger password policies and multi-factor authentication (MFA) to prevent credential-stuffing exploits.
TPRM report: https://www.rankiteo.com/company/level-3-communications
"id": "lev801082025",
"linkid": "level-3-communications",
"type": "Breach",
"date": "8/2020",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '1,942',
'industry': 'Telecommunications',
'location': 'United States',
'name': 'CenturyLink Communications (now Lumen '
'Technologies)',
'type': 'Telecommunications Company'}],
'attack_vector': 'Password Guessing Attack',
'customer_advisories': ['Written notifications sent between September 21–25, '
'2020'],
'data_breach': {'data_exfiltration': 'Potential',
'number_of_records_exposed': '1,942',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'Moderate (PII)',
'type_of_data_compromised': ['Usernames',
'Email Addresses',
'First and Last Names',
'Service Addresses',
'Billing Addresses',
'Other Related Information']},
'date_publicly_disclosed': '2020-09-21',
'description': 'The Maine Office of the Attorney General reported a data '
'breach involving CenturyLink Communications, with the breach '
'occurring between August 20 and August 31, 2020. '
'Approximately 1,942 accounts were affected due to a '
'sophisticated password guessing attack on the MyCenturyLink '
'customer account website, potentially exposing usernames, '
'email addresses, first and last names, service and billing '
'addresses, and other related information. Written '
'notifications were sent to customers starting September 21, '
'2020, with all letters mailed by September 25, 2020.',
'impact': {'data_compromised': ['Usernames',
'Email Addresses',
'First and Last Names',
'Service Addresses',
'Billing Addresses',
'Other Related Information'],
'identity_theft_risk': 'Potential',
'systems_affected': ['MyCenturyLink Customer Account Website']},
'initial_access_broker': {'entry_point': 'MyCenturyLink Customer Account '
'Website'},
'post_incident_analysis': {'root_causes': ['Weak or Reused Passwords '
'Vulnerable to Guessing Attacks']},
'references': [{'source': 'Maine Office of the Attorney General'}],
'regulatory_compliance': {'regulatory_notifications': ['Maine Office of the '
'Attorney General']},
'response': {'communication_strategy': ['Written Notifications to Affected '
'Customers'],
'remediation_measures': ['Customer Notifications (via mail)']},
'title': 'CenturyLink Communications Data Breach (2020)',
'type': 'Data Breach',
'vulnerability_exploited': 'Weak or Reused Passwords'}