MisuseFinancial ServicesFinanceData MishandlingEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentHealth (basic)MediumResolved

RUSSELL INVESTMENTS CAPITAL, LLC

bd_070b3b9433c9c6f5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 22, 2017

Filed

Mar 7, 2017

To disclose

13 days

Affected

1state residents only

Linked

3 filings

Confidence

68%

Full breach record for RUSSELL INVESTMENTS CAPITAL, LLC →

Russell Investments notified the NH Attorney General of a data breach involving one NH resident. On Feb 22, 2017, an employee sent PII (SSN, DOB, salary, etc.) of US employees/dependents to a personal Gmail account. Russell investigated, removed data from personal devices, reset credentials, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 days

Feb 22, 2017

Discovered

Mar 7, 2017

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_0fbdf552fd581edf2017-03-07Verified
Washington State AGbd_ab072dd7acabb19a2017-03-07Candidate

Name: RUSSELL INVESTMENTS CAPITAL, LLC
norm: russell investments
Domain: russellinvestments.com

Name: RUSSELL INVESTMENTS CAPITAL, LLC
norm: russell investments
Domain: russellinvestments.com
Industry: Financial Servicesllm

Discovered: Feb 22, 2017
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmploymentHealth (basic)
Data elements: Date of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified New Hampshire Attorney General
Initial access: insider_action

During the incident: Russell Investments' Information Security and Incident Response team investigated and mitigated the data breach
Removed the personal information from non-Russell Investments managed devices and cloud accounts
Rotating the privileged credentials and keys
Recovered the breached PII from the associate who caused the data breach
Deleted all known copies of the breached PII stored outside of Russell Investments' systems
Resetting key passwords and other credentials
Changes made: Revisions to human resources' policies
Revisions to IT polices related to privileged systems access by employees
Implementing new data loss prevention functionality in our computer systems
Blocking access to unapproved online storage services
Enhancements to our virtual private network used for remote access to employees' work environments
Providing two years of no-cost credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 7 · first

Washington State AGMar 7 · first

New Hampshire State AGMar 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/russell-investments-20170307.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 7, 2017
Raw hash: e25adc1bd342f1a4472cbee1c001ffa98afef5e240ff3dd775e736436e88f07c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityRUSSELL INVESTMENTS CAPITAL, LLC

Victim entityRUSSELL INVESTMENTS CAPITAL, LLC

Incidentdiscovered Feb 22, 2017

Stated responseRussell Investments' Information Security and Incident Response team investigated and mitigated the data breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov