Subject: Re: MLP Leak - Actions Pending Jeff's Review
From: "Curtis, Jeff" <[email-masked]>
To: "McGowan, Brian" <[email-masked]>
Cc: "Melanson, Steve" <[email-masked]>, "Pomer, David" <[email-masked]>, "Ellis, Joshua" <[email-masked]>, "Morris, Michael" <[email-masked]>, "Catulo, Daniel" <[email-masked]>, "Matlach, Nicholas" <[email-masked]>
Date: Mon, 16 Oct 2017 13:41:41 -0400

Thanks Brian. Apologize for the delayed reply. I was travelling home from Dublin on Saturday and didn’t catch this e-mail until this AM.

Russian attack on the servers? That does sound a little far-fetched but who knows… Glad you took the precautionary measure to break access to the isilon servers just to be safe. No issues reported yet…

—

Jeff Curtis

Director of Distribution and Creative Services

Hasbro Studios

3333 Empire Ave. Suite 500

Burbank, CA 91505

(818) 478-4803 Office

(818) 307-9739 Cell

From: "McGowan, Brian" <[email-masked]>

Date: Sunday, October 15, 2017 at 5:27 PM

To: Jeff Curtis <[email-masked]>

Cc: "Melanson, Steve" <[email-masked]>, "Pomer, David" <[email-masked]>, "Ellis, Joshua" <[email-masked]>, "Morris, Michael" <[email-masked]>, "Catulo, Daniel" <[email-masked]>, "Matlach, Nicholas" <[email-masked]>

Subject: RE: MLP Leak - Actions Pending Jeff's Review

Jeff, we proceeded with making access changes to the Post share (based on Steve’s approval).  If anyone experiences issues Monday morning please ask them to file a help desk ticket and assign it to Danny Catulo.

Brian

From: McGowan, Brian

Sent: Saturday, October 14, 2017 10:28 PM

To: Curtis, Jeff <[email-masked]>

Cc: Melanson, Steve <[email-masked]>; Pomer, David <[email-masked]>; Ellis, Joshua <[email-masked]>; Morris, Michael <[email-masked]>; Catulo, Daniel <[email-masked]>; Matlach, Nicholas <[email-masked]>;
McGowan, Brian <[email-masked]>

Subject: MLP Leak - Actions Pending Jeff's Review

Jeff, we received an email from someone reportedly from Harmonize Entertainment stating the MLP leak was due to a Russian attack against the Burbank servers.  We don’t have reason to believe that’s a legitimate claim but we want to take
some precautions nonetheless.  Also, we determined that we don’t have the right access restrictions in place for the “Post” Isilon server so we plan to correct that at the same time.

We’d like to break all access to the Isilon as soon as you give us the green light.  This will disrupt any connections to it (including any external attackers if in fact we’ve been compromised).  We’ll rebuild access by allowing only those individuals you provided
to Ed Gianetti (15 people).  We’re aiming for early Monday morning to restore access depending on when we can get started.

We’re unsure if the claim of the external attack is legitimate but we’d like to proceed with some urgency.  Let me know if you’d like to discuss - my cell is 508.472.6263.

Brian

PS, the network team performed a quick analysis of current traffic on the Burbank network and it’s very low. We based the urgency level in part on that analysis.  If traffic indicated a potential ongoing leak we’d have moved much more quickly.