AccidentalTechnologyInformationMisconfigurationCustomer Data InvolvedGovernment IDPIIMediumContained

R. R. DONNELLEY & SONS COMPANY

bd_1725f1d0b91d0bbb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 29, 2020

Filed

Nov 30, 2020

To disclose

5 weeks

Affected

56state residents only

Linked

4 filings

Confidence

66%

Full breach record for R. R. DONNELLEY & SONS COMPANY →4 incidents on file

R.R. Donnelley & Sons Company notified NH AG of a programming error on Oct 9, 2020, where SSNs were printed on envelopes for former employees' benefits notices. Discovered Oct 29, 2020. 56 NH residents affected. Notification sent Nov 16, 2020. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 20 days

discovery → filing · 5 weeks / 32 days

Oct 9, 2020

Begins

Oct 29, 2020

Discovered

Nov 30, 2020

Filed

vs. sector median

14 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_8b46e5035a88cffc2020-11-15 · +15dVerified
Massachusetts State AGbd_7d29f552f93f65ce2020-11-13 · +17dVerified
Maine State AGbd_86b509c9f0d3f3e92020-11-13 · +17dCandidate

Name: R. R. DONNELLEY & SONS COMPANY
norm: r r donnelley sons
Domain: rrd.com

Name: R. R. DONNELLEY & SONS COMPANY
norm: r r donnelley sons
Domain: rrd.com
Industry: Technologyllm

Discovered: Oct 29, 2020
Breach occurred: Oct 9, 2020
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 16, 2020
Affected individuals: 56state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Misconfiguration

During the incident: Began investigating to begin corrective action
No longer providing Employee User ID as a data field to our printing vendor for their use in matching personalized letters to personalized envelopes
Working to change Employee User ID to a unique identifier that is something other than the employee's Social Security Number
Offered twenty-four months of credit monitoring services to the impacted individuals
Changes made: No longer providing Employee User ID as a data field to our printing vendor for their use in matching personalized letters to personalized envelopes
Working to change Employee User ID to a unique identifier that is something other than the employee's Social Security Number
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGNov 13 · first

Maine State AGNov 13 · first

Indiana State AG+2d

New Hampshire State AG+17d · this page

Pattern: first filing Nov 13 (MA), last Nov 30 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/r-r-donnelley-sons-20201130.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2020
Raw hash: 063f35437efef252000b87b988ce48ec4968a99fc92d15bc6e3c4e91a0ddcad3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityR. R. DONNELLEY & SONS COMPANY

Victim entityR. R. DONNELLEY & SONS COMPANY

Incidentdiscovered Oct 29, 2020

Stated responseBegan investigating to begin corrective action

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov