MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

JEANNE D'ARC CREDIT UNION

bd_09264dd616bb9d8e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 29, 2011

Filed

Nov 30, 2011

To disclose

18 weeks

Affected

327state residents only

Linked

2 filings

Confidence

66%

Full breach record for JEANNE D'ARC CREDIT UNION →

Jeanne D'Arc Credit Union notified NH AG of an insider breach where a departing employee used a USB drive to exfiltrate member data (names, SSNs, loan account numbers) on Dec 27, 2010. The incident was discovered on July 29, 2011, affecting 327 NH members. The employee provided an affidavit of non-use. Remediation included enhanced removable media monitoring and encryption.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 214 days

discovery → filing · 18 weeks / 124 days

Dec 27, 2010

Begins

Jul 29, 2011

Discovered

Nov 30, 2011

Filed

vs. sector median

+9 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_b7be7d671d6a17602011-12-02 · +2dVerified

Name: JEANNE D'ARC CREDIT UNION
norm: jeanne d arc credit union
Domain: jdcu.com
Industry: financial_services

Name: JEANNE D'ARC CREDIT UNION
norm: jeanne d arc credit union
Domain: jdcu.com
Industry: financial_services
Industry: Financial Servicesllm

Discovered: Jul 29, 2011
Breach occurred: Dec 27, 2010
Undetected for: 214 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 327state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Insider
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: InternalSecondary
Regulator citations: Provided copy of this letter to the Commissioner of Banks
Initial access: removable_media

During the incident: Engaged FIS Governmental Services to perform an analysis of the disclosed computer files
Recovered the thumb drive device that contained the computer files in question
Obtained a sworn affidavit from our former employee indicating that she made no unauthorized use or further disclosure of the disclosed personal information
Received assurances from our former employee's subsequent employer that it has taken appropriate safeguards to prevent further disclosure of the personal information
Changes made: Implementing more secure monitoring software that will alert our IT department when a large amount of files are being copied to any removable media
Restricting employees who have a need to copy files to removable media to only copy those files to encrypted, password protected media
Re-notify all of our employees of our data security and ethics policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(124 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGNov 30 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jeanne-darc-20111130.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2011
Raw hash: b7005101496be2bf05a420015b1e98acb3e3a4be76ce5511bc5acc33b4852fc5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJEANNE D'ARC CREDIT UNION

Victim entityJEANNE D'ARC CREDIT UNION

Incidentdiscovered Jul 29, 2011

Stated responseEngaged FIS Governmental Services to perform an analysis of the disclosed computer files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov