PhysicalProfessional ServicesProfessional ServicesTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Deloitte

bd_07bc05183b5394a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 21, 2007

Filed

Dec 5, 2007

To disclose

14 days

Affected

70state residents only

Confidence

66%

Full breach record for Deloitte →4 incidents on file

Deloitte & Touche USA LLP notified NH AG of a breach involving a stolen laptop from vendor IKON Office Solutions. The unencrypted laptop contained PII (names, SSNs, DOBs) of current/former partners and employees. Incident discovered Nov 21, 2007. 70 NH residents affected. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 14 days

Nov 19, 2007

Begins

Nov 21, 2007

Discovered

Dec 5, 2007

Filed

vs. sector median

17 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed70 affectedView incident

Name: Deloitte
norm: deloitte
Domain: deloitte.com

Name: Deloitte
norm: deloitte
Domain: deloitte.com
Industry: Professional Servicesllm

Discovered: Nov 21, 2007
Breach occurred: Nov 19, 2007
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 5, 2007
Affected individuals: 70state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Filed Legal Notice of Information Security Breach with New Hampshire Office of the Attorney General

During the incident: Vendor reported theft to Walnut Creek, California police department
Notifying all affected individuals via written letter through first class mail
Offering Triple Advantage Deluxe credit monitoring service free of charge for one year
Suspended all work with the vendor on the pension record scanning project
Ongoing program to identify vendors who access confidential information and confirm appropriate protections
Changes made: Suspended all work with the vendor on the pension record scanning project until vendor demonstrates appropriate data security protections
Ongoing program to identify vendors who access confidential information regarding personnel and confirm they have implemented appropriate protections
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/deloitte-touche-20071205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2007
Raw hash: a535aa9043e008fe9df46a614c077fe499774242485ec0778a9347be0450f4b1

Reporting entityDeloitte

Victim entityDeloitte

Incidentdiscovered Nov 21, 2007

Stated responseVendor reported theft to Walnut Creek, California police department

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov