AccidentalProfessional ServicesProfessional ServicesMisdeliveryEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Nordic Consulting Partners, Inc.

bd_1c240e0f65757861 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 21, 2016

Filed

Aug 1, 2016

To disclose

11 days

Affected

6state residents only

Linked

3 filings

Confidence

66%

Full breach record for Nordic Consulting Partners, Inc. →2 incidents on file

Nordic Consulting Partners, Inc. notified the NH Attorney General that on July 21, 2016, an HR employee inadvertently sent an email attachment containing names, addresses, dates of birth, SSNs, and insurance plan names of employees and dependents to current and former employees. The error was caught shortly after sending; messages were recalled from internal inboxes and hard-deleted from external accounts. Notification letters were sent to affected individuals, including six New Hampshire residents.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 days

Jul 21, 2016

Begins

Jul 21, 2016

Discovered

Aug 1, 2016

Filed

vs. sector median

17 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_a78807437156b7982016-08-01Verified
Montana State AGbd_25731e984404ed762016-07-29 · +3dCandidate

Name: Nordic Consulting Partners, Inc.
norm: nordic consulting

Name: Nordic Consulting Partners, Inc.
norm: nordic consulting
Industry: Professional Servicesllm

Discovered: Jul 21, 2016
Breach occurred: Jul 21, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified the State of New Hampshire Office of the Attorney General

During the incident: Employed a tool to recall the message and delete it from recipients' inboxes within Nordic's domain
Reached individually to confirm a hard deletion of this e-mail for those with non-Nordic email accounts
Sent notification letters out to all individuals whose personal information was listed in the email attachment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 days(11 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJul 29 · first

Massachusetts State AG+3d

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nordic-consulting-20160801.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 1, 2016
Raw hash: f7743d57c1a6b74fd3a8d859eff54af324dd6b957f177a57d4e28000d74499f4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNordic Consulting Partners, Inc.

Victim entityNordic Consulting Partners, Inc.

Incidentdiscovered Jul 21, 2016

Stated responseEmployed a tool to recall the message and delete it from recipients' inboxes within Nordic's domain

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov