Social EngineeringProfessional ServicesProfessional ServicesPhishingBECTargetedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Envelopes Unlimited

bd_134779da58b5ad30 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 29, 2017

Filed

Mar 31, 2017

To disclose

2 days

Affected

1state residents only

Confidence

66%

Full breach record for Envelopes Unlimited →

Envelopes Unlimited reported a spear-phishing incident where an employee was tricked into sending 2016 W-2 forms containing names, addresses, SSNs, and earnings information to an attacker. The incident was discovered on March 29, 2017. One New Hampshire resident was affected. The company notified the FBI, IRS, and state taxing authorities, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 2 days

Mar 29, 2017

Begins

Mar 29, 2017

Discovered

Mar 31, 2017

Filed

vs. sector median

18 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Envelopes Unlimited
norm: envelopes unlimited

Name: Envelopes Unlimited
norm: envelopes unlimited
Industry: Professional Servicesllm

Discovered: Mar 29, 2017
Breach occurred: Mar 29, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 31, 2017
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI, IRS, and state taxing authorities of the incident
Initial access: phishing_link

During the incident: Notified affected current employees by email
Began mailing notification letters via U.S. Mail to 1 New Hampshire resident
Offering affected individuals a free one-year membership in credit monitoring and identity theft protection services from Experian
Provided a call center for affected individuals to call with any questions they may have
Notified the FBI, IRS, and state taxing authorities of the incident
Changes made: Aggressively analyzing where process changes are needed and will take the appropriate actions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 2 days(2 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/envelopes-unlimited-20170331.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2017
Raw hash: 80296744129a5c7536d05af9973e02367f7e5b6dccb9281a78b0f5b51dcd69f9

Reporting entityEnvelopes Unlimited

Victim entityEnvelopes Unlimited

Incidentdiscovered Mar 29, 2017

Stated responseNotified affected current employees by email

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov