Social EngineeringTechnologyInformationPhishingEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancialMediumContained

PIVOTAL SOFTWARE, INC.

bd_0fbf9611d039da3d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 22, 2016

Filed

Mar 30, 2016

To disclose

8 days

Affected

14state residents only

Linked

3 filings

Confidence

67%

Full breach record for PIVOTAL SOFTWARE, INC. →

Pivotal Software, Inc. notified New Hampshire AG that an employee was targeted by a CEO impersonation phishing scam on March 22, 2016. The attacker obtained a file containing 2015 W-2 data (names, addresses, income, SSNs/TINs) for 14 NH residents. Pivotal notified law enforcement/IRS and provided 3 years of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 days

Mar 22, 2016

Discovered

Mar 30, 2016

Filed

vs. sector median

18 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_f27735e9912788ef2016-03-30Candidate
Massachusetts State AGbd_409d4842e28549f02016-04-01 · +2dVerified

Name: PIVOTAL SOFTWARE, INC.
norm: pivotal software
Domain: pivotal.io

Name: PIVOTAL SOFTWARE, INC.
norm: pivotal software
Domain: pivotal.io
Industry: Technologyllm

Discovered: Mar 22, 2016
Materiality determined: —
Notification sent: Mar 31, 2016
Affected individuals: 14state-resident count only
Data types: Identity (basic)Government IDFinancial
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Contacted the IRS
Initial access: phishing_link

During the incident: Notified law enforcement and contacted the IRS
Provided the IRS with the list of impacted employees
Arranged for AllClear ID to provide employees with three years of identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGMar 30 · first

New Hampshire State AGMar 30 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pivotal-software-20160330.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2016
Raw hash: 96cc3729ac0acbdd4347d7a5e6b76d74e282b15b457bb7fca7a5a8bafec04ea0

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPIVOTAL SOFTWARE, INC.

Victim entityPIVOTAL SOFTWARE, INC.

Incidentdiscovered Mar 22, 2016

Stated responseNotified law enforcement and contacted the IRS

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov