Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

CUSHMAN & WAKEFIELD, INC.

bd_194961ce53a892c9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2018

Filed

Jul 5, 2018

To disclose

18 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for CUSHMAN & WAKEFIELD, INC. →2 incidents on file

Cushman and Wakefield notified the NH Attorney General of a data breach affecting one New Hampshire resident. In February 2018, phishing emails led employees to disclose credentials, allowing unauthorized access to accounts containing names, emails, SSNs, and bank account numbers between Feb 26 and Mar 1, 2018. The company locked accounts, reset passwords, blocked malicious IPs, retained forensic experts, notified law enforcement, and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 weeks / 129 days

Feb 26, 2018

Begins

Feb 26, 2018

Discovered

Jul 5, 2018

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_db4b7b954dbf0f182018-07-05Verified

Name: CUSHMAN & WAKEFIELD, INC.
norm: cushman wakefield
Domain: cushmanwakefield.com

Name: CUSHMAN & WAKEFIELD, INC.
norm: cushman wakefield
Domain: cushmanwakefield.com
Industry: Professional Servicesllm

Discovered: Feb 26, 2018
Breach occurred: Feb 26, 2018 – Mar 1, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 5, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the Attorney General of New Hampshire
Initial access: phishing_link

During the incident: Temporarily locking the accounts of affected users
Forcing password resets
Identifying and blocking access to C&W systems from suspected malicious IP addresses
Retained the services of a firm specializing in data breaches to assist in its response
Reporting this matter to law enforcement where appropriate
Providing no-cost credit monitoring services to the affected employees
Changes made: Provides training to its employees regarding awareness and detection of phishing attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(129 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJul 5 · first

New Hampshire State AGJul 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cushman-wakefield-20180705.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 5, 2018
Raw hash: 94664aeee81c38e065edbed56bd7cdbbf25ae10314cd13022910bd1db983e5c8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCUSHMAN & WAKEFIELD, INC.

Victim entityCUSHMAN & WAKEFIELD, INC.

Incidentdiscovered Feb 26, 2018

Stated responseTemporarily locking the accounts of affected users

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov