Social EngineeringFinancial ServicesFinancePhishingTargetedEmployee Data InvolvedPIIIdentity (basic)Government IDEmploymentMediumContained

PRIMARY RESIDENTIAL MORTGAGE, INC.

bd_17fe40f1c0b75faf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 25, 2016

Filed

May 9, 2016

To disclose

11 weeks

Affected

48state residents only

Linked

2 filings

Confidence

66%

Full breach record for PRIMARY RESIDENTIAL MORTGAGE, INC. →2 incidents on file

Primary Residential Mortgage, Inc. disclosed a phishing attack on February 25, 2016, compromising 2015 W-2 forms of current and former employees. 48 New Hampshire residents were affected. Data included SSNs, addresses, and salary info. PRMI notified employees, engaged IRS/FTC/IG, and provided 1 year of LifeLock identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 74 days

Feb 25, 2016

Begins

Feb 25, 2016

Discovered

May 9, 2016

Filed

vs. sector median

+2 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_8bd34d0a88da12512016-05-13 · +4dVerified

Name: PRIMARY RESIDENTIAL MORTGAGE, INC.
norm: primary residential mortgage
Domain: primeresidentialmortgage.com

Name: PRIMARY RESIDENTIAL MORTGAGE, INC.
norm: primary residential mortgage
Domain: primeresidentialmortgage.com
Industry: Financial Servicesllm

Discovered: Feb 25, 2016
Breach occurred: Feb 25, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 9, 2016
Affected individuals: 48state-resident count only
Data types: PIIIdentity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Working with the investigative units of the U.S. Inspection ServiceWorking with the investigative units of the Internal Revenue ServiceNotified the Federal Trade CommissionNotified the Office of the Inspector General
Initial access: phishing_link

During the incident: Worked to uncover all those impacted by the breach
Prepared a comprehensive notification
Notified New Hampshire residents impacted that are current employees via a company-wide email
Set up branch manager phone calls to help communicate the information
Sent hard-copy notice to all New Hampshire residents impacted by the breach
Implemented additional security measures and employee training
Working with the investigative units of the U.S. Inspection Service and the Internal Revenue Service
Notified the Federal Trade Commission and the Office of the Inspector General
Contracted with a third party, LifeLock, to provide one year of identity theft protection services
Changes made: Implemented additional security measures
Employee training designed to prevent a reoccurrence of such an attack
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMay 9 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/primary-residential-20160609.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2016
Raw hash: 302fcfc5cd42cbf402266c0210f1991fcd28462fe51ce8e8d7defbb9e85eede9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPRIMARY RESIDENTIAL MORTGAGE, INC.

Victim entityPRIMARY RESIDENTIAL MORTGAGE, INC.

Incidentdiscovered Feb 25, 2016

Stated responseWorked to uncover all those impacted by the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov