HackingHealthcareTechnologyHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Genentech, Inc.

bd_1a9d58174e5044dc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 17, 2011

Filed

Sep 29, 2011

To disclose

6 weeks

Affected

10state residents only

Linked

2 filings

Confidence

66%

Full breach record for Genentech, Inc. →2 incidents on file

Genentech notified the NH AG of a security incident discovered on August 17, 2011, involving unauthorized access to a vendor's computers. The breach exposed personal and medical information of 10 New Hampshire residents and approximately 10 Puerto Rico residents. Data included names, SSNs, driver's licenses, and medical info. Genentech engaged forensic investigators and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 43 days

Aug 17, 2011

Discovered

Sep 29, 2011

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_e08d73e187820f552011-09-29Verified

Name: Genentech, Inc.
norm: genentech
Domain: gene.com

Name: Genentech, Inc.
norm: genentech
Domain: gene.com
Industry: HealthcarellmTechnologyllm

Discovered: Aug 17, 2011
Materiality determined: —
Notification sent: Sep 29, 2011
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Initial access: trusted_relationship

During the incident: Secured the computer network system from further vulnerability
Investigate what happened
Arrange identify theft protection services for the people affected
Engaged an independent security firm to assist our investigation and to make additional recommendations regarding security for Genentech and our vendors
Providing each affected individual with credit monitoring and identity theft protection insurance
Changes made: Taken steps to improve our security controls to prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGSep 29 · first

New Hampshire State AGSep 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/genentech-20110929.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 29, 2011
Raw hash: b97dcdc395f0dd88c8a37c1c99abdd9efb5580e809317dda3599da8de300fafb

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGenentech, Inc.

Victim entityGenentech, Inc.

Incidentdiscovered Aug 17, 2011

Stated responseSecured the computer network system from further vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov