Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

TERMINIX GLOBAL HOLDINGS, INC.

bd_07b98707c56023de · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 16, 2020

Filed

Oct 19, 2020

To disclose

5 weeks

Affected · nationwide

14,70861 in this filing

Linked

4 filings

Confidence

66%

Full breach record for TERMINIX GLOBAL HOLDINGS, INC. →3 incidents on file

Terminix and former affiliate ServiceMaster reported a data breach caused by phishing. An employee's Office 365 account was compromised, leading to email forwarding from Sept 10-22, 2020. On Sept 26, the company discovered an email containing PII (name, SSN, DOB, employment dates, 401K balance) for 14,708 current and former employees. 61 were NH residents. Notifications were sent on Oct 9, 2020, offering 2 years of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 5 weeks / 33 days

Sep 10, 2020

Begins

Sep 16, 2020

Discovered

Oct 19, 2020

Filed

vs. sector median

15 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_3aab291eabee79222020-10-11 · +8dCandidate
California State AGbd_63678ffc75ec207d2020-10-09 · +10dVerified
Indiana State AGbd_da7fd964efebe1142020-10-09 · +10dVerified

Name: TERMINIX GLOBAL HOLDINGS, INC.
norm: terminix global
Domain: servicemasterclr.com

Name: TERMINIX GLOBAL HOLDINGS, INC.
norm: terminix global
Domain: servicemasterclr.com
Industry: Professional Servicesllm

Discovered: Sep 16, 2020
Breach occurred: Sep 10, 2020 – Sep 22, 2020
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 9, 2020
Affected individuals: 14,708state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notifying state authorities
Initial access: phishing_link

During the incident: Disabled the forwarding of the emails and contained the breach
Modified our email filtering and account authorization protocol
Working with law enforcement agencies to investigate this cybercrime
Notifying state authorities
Notified the provider of our 401 K plans and the major credit agencies
Continuing to monitor the security of our systems
Engaged ID Experts / IDX to assist with communicating via letter
Offering two years of identity theft protection services
Changes made: Requiring teammates to complete the annual security awareness training
Issued specialized training to particularly high-risk groups to help them recognize extremely sophisticated phishing attempts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGOct 9 · first

Indiana State AGOct 9 · first

Maine State AG+2d

New Hampshire State AG+10d · this page

Pattern: first filing Oct 9 (CA), last Oct 19 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/terminix-servicemaster-20201019.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2020
Raw hash: dc56cec88b68452f0b94e2c7068b8eb585e75c0765ce01ce7a583f7c9e02009a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTERMINIX GLOBAL HOLDINGS, INC.

Victim entityTERMINIX GLOBAL HOLDINGS, INC.

Incidentdiscovered Sep 16, 2020

Stated responseDisabled the forwarding of the emails and contained the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov