HackingFinancial ServicesTechnologyFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

EXPERIAN SERVICES CORP.

bd_1b2c483f10d8174f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 1, 2012

Filed

May 17, 2012

To disclose

15 weeks

Affected

4state residents only

Linked

4 filings

Confidence

66%

Full breach record for EXPERIAN SERVICES CORP. →28 incidents on file

Experian notified 4 New Hampshire residents of potential unauthorized access to consumer credit reports between Nov 2010 and Mar 2012. Experian discovered the incident in Feb 2012. While sensitive data elements were redacted, Experian provided 2 years of credit monitoring. Access likely via valid credentials.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 457 days

discovery → filing · 15 weeks / 106 days

Nov 1, 2010

Begins

Feb 1, 2012

Discovered

May 17, 2012

Filed

vs. sector median

+7 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_36d767eacf59027b2012-05-18 · +1dVerified
New Hampshire State AGbd_6ac1f7cc0432596c2012-05-18 · +1dVerified
New Hampshire State AGbd_1879e4a94d1f68932012-05-04 · +13dCandidate

Name: EXPERIAN SERVICES CORP.
norm: experian services

Name: EXPERIAN SERVICES CORP.
norm: experian services
Industry: Financial ServicesllmTechnologyllm

Discovered: Feb 1, 2012
Breach occurred: Nov 1, 2010 – Mar 1, 2012
Undetected for: 457 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 17, 2012
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the Attorney General - New Hampshire
Initial access: valid_credentials

During the incident: Began mailing letters on May 17, 2012
Provided consumers with free credit monitoring services
Conducted investigation of computer log files
Changes made: Provided two years of complimentary credit report monitoring through Experian’s ProtectMyID Elite product
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

New Hampshire State AGMay 4 · first

New Hampshire State AG+13d · this page

Massachusetts State AG+14d

New Hampshire State AG+14d

Pattern: first filing May 4 (NH), last May 18 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/experian-20120517.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2012
Raw hash: d1a9c3db55a99d94f9723273a5d93dfb481fc40525c2f4e9a2008c85cb68361b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityEXPERIAN SERVICES CORP.

Victim entityEXPERIAN SERVICES CORP.

Incidentdiscovered Feb 1, 2012

Stated responseBegan mailing letters on May 17, 2012

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov