AccidentalFinancial ServicesTechnologyFinanceMisdeliveryDelayed DiscoveryGovernment IDIdentity (basic)MediumContained

Alight Solutions LLC

bd_018c338c00d4dff8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 20, 2019

Filed

Aug 20, 2019

To disclose

13 weeks

Affected

57state residents only

Linked

4 filings

Confidence

66%

Full breach record for Alight Solutions LLC →6 incidents on file

Alight Solutions LLC administers the Federal Reserve Benefits Center. In May 2019, a routine security review revealed that from Sept 2014 to June 2019, system-generated emails inadvertently included recipients' SSNs in email properties. Additionally, from Oct 2016 to Feb 2019, URLs linking to third-party providers contained SSNs and DOBs. Alight encrypted the data and offered 2 years of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1701 days

discovery → filing · 13 weeks / 92 days

Sep 22, 2014

Begins

May 20, 2019

Discovered

Aug 20, 2019

Filed

vs. sector median

+5 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_69bb2e24c95a52232019-08-20Verified
California State AGbd_8bb43e9130dac3222019-08-20Verified
New Hampshire State AGbd_971b290d0cebc8292019-08-21 · +1dVerified

Name: Alight Solutions LLC
norm: alight solutions
Domain: alight.com

Name: Alight Solutions LLC
norm: alight solutions
Domain: alight.com
Industry: Financial ServicesllmTechnologyllm

Discovered: May 20, 2019
Breach occurred: Sep 22, 2014 – Jun 29, 2019
Undetected for: 1,701 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 57state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged

During the incident: Initiated an investigation
Encrypted Social Security Numbers in the email properties of both forms of system-generated emails
Removed personal information from the URLs linking SmartBenefits to the trusted third-party websites
Offering two years of identity theft protection through InfoArmor
Changes made: Encrypted Social Security Numbers in the email properties
Removed personal information from URLs
Continually evaluate and modify practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGAug 20 · first

California State AGAug 20 · first

Montana State AGAug 20 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-69.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2019
Raw hash: 87aeb32ceecaf8d76ca1d85c2d5ed0be649ba9c23be609414c5191ca04a145dd

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAlight Solutions LLC

Victim entityAlight Solutions LLC

Incidentdiscovered May 20, 2019

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov