MisuseRetail & ConsumerRetailData MishandlingEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHighContained

THE J. M. SMUCKER COMPANY

bd_1a4345293788ffa0 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 5, 2010

Filed

Apr 29, 2010

To disclose

24 days

Affected · nationwide

5,9761 in this filing

Linked

2 filings

Confidence

66%

Full breach record for THE J. M. SMUCKER COMPANY →2 incidents on file

The J.M. Smucker Company experienced an unauthorized data exposure on April 5, 2010, when an employee emailed files containing personal data of 5,976 employees and dependents to a relative for technical assistance. The data included SSNs, addresses, and financial info. Smucker contained the data, engaged the FBI and forensic experts, and notified affected individuals on April 29, 2010, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 days

Apr 5, 2010

Begins

Apr 5, 2010

Discovered

Apr 29, 2010

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_0f0c92fb6e81d1db2010-05-03 · +4dVerified

Name: JONES DAY
norm: jones day
Domain: jonesday.com

Name: THE J. M. SMUCKER COMPANY
norm: the j m smucker
Industry: Retail & Consumerllm

Discovered: Apr 5, 2010
Breach occurred: Apr 5, 2010
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 29, 2010
Affected individuals: 5,976state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: InternalSecondary
Regulator citations: Notified the Federal Bureau of Investigation (FBI)Notified the New Hampshire Office of the Attorney General
Third party: via Relative of EmployeeExternal party with no employment relationship
Initial access: insider_action

During the incident: Contacted the Federal Bureau of Investigation (FBI)
Obtained possession of the employee’s work and home computer
Arranged for an independent third party provider to conduct further forensic analysis
Disabled access to the programmer’s work computer
Quarantined the e-mail
Removed the e-mail and attachment from their systems
Notified the major national credit reporting agencies
Provided affected employees with a full package of credit protection service and credit insurance for one year free of charge
Established a toll-free number for employees to call for further information and assistance
Changes made: Implemented disciplinary actions for the employee
Continuing to carefully monitor the situation
Taking steps to reduce the risk of future unauthorized data transmissions or exposures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 29 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jm-smucker-20100429.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2010
Raw hash: 662c04050320d270e8114e08fc2adcf6d8b2d658785ef7228f84135608dbc3c7

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJONES DAY

Victim entityTHE J. M. SMUCKER COMPANY

Incidentdiscovered Apr 5, 2010

Stated responseContacted the Federal Bureau of Investigation (FBI)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov