Subject: RE: MLP Leak
From: "Ellis, Joshua" <[email-masked]>
To: "Gianetti, Ed" <[email-masked]>
Date: Thu, 2 Nov 2017 15:50:44 -0400

At this time there is no indication of an external attack on the servers where the files are located. The MLP movie was on the Isilon share that was misconfigured and open to internal users. The “storytelling” share is configured with limited
access to three specific groups ( two administrators groups, and the BUR-storytelling group) and therefore a much smaller number of people.

I am still sifting through VPN logs from Burbank, as well as going through some of the system logs on the servers.

Josh

Joshua Ellis|Cyber Security|Hasbro|401.431.8176|
[email-masked]

From: Gianetti, Ed

Sent: Thursday, November 2, 2017 3:42 PM

To: Ellis, Joshua <[email-masked]>

Subject: RE: MLP Leak

So to the best of your knowledge these servers were not hacked and no foreign device was used to download any MLP content? But a lot of internal people would have had access to these files, correct?

From: Ellis, Joshua

Sent: Thursday, November 02, 2017 3:28 PM

To: Gianetti, Ed <[email-masked]>

Subject: RE: MLP Leak

Hi Ed,

Sorry I have been getting pulled on a few different things this week. How much detail are you looking for? These are some of my notes.

MLP Leak Investigation:

We found that there were some permission issues on the Isilon allowing all users on the network to have access to the directory where the MLP movie was stored "post/_OUTSOURCE_SERIES/MOVIES/MY_LITTLE_PONY_FEATURE/CurrentCut/Sent to Hasbro_MLPTM_FullAssemblyDNXUpdated_08Aug17/"

(This has since been changed)

Directory permissions gathered on both USBURISI01 and USBRUFS02 for the following directories (Folders):

\\USBURISI01\post

\\USBURISI01\IFS\post

\\USBRUFS02\storytelling\

Remote acquisition of logs and registry from windows system:

USBRUFS02

Timelining of USBRUFS02 registry in process.

Failed attempt at remote acquisition of workstation;

WS-THOMPSE

Joshua Ellis|Cyber Security|Hasbro|401.431.8176|
[email-masked]

From: Gianetti, Ed

Sent: Thursday, November 2, 2017 11:34 AM

To: Ellis, Joshua <[email-masked]>

Subject: FW: MLP Leak

Were you able to put anything in writing, Legal is calling me this afternoon with some questions on the investigation.

From: Gianetti, Ed

Sent: Monday, October 30, 2017 10:54 AM

To: Ellis, Joshua <[email-masked]>

Subject: MLP Leak

Hi Josh,

Can I possible get in writing an update of what your audits of the Isilon server and the Storytelling server at Burbank have found to date regarding the MLP Leak?

Thanks,

Ed