MisuseEnergy & UtilitiesUtilitiesPrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Chevron Corporation

bd_1c5e6ab0af107c7f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 4, 2016

Filed

Oct 12, 2016

To disclose

19 weeks

Affected

1state residents only

Confidence

67%

Full breach record for Chevron Corporation →

Chevron U.S.A. Inc. notified the New Hampshire Attorney General of a data security incident affecting one NH resident. A contractor copied files containing names, driver's license numbers, passport numbers, and dates of birth to a personal hard drive after his contract expired. Chevron discovered the missing files in June 2016, confirmed removal in July 2016, and began notifying the affected individual in August 2016. Chevron provided credit monitoring services and is enhancing security training and safeguards.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 weeks / 130 days

Jun 4, 2016

Discovered

Oct 12, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Chevron Corporation
norm: chevron
Domain: chevron.com
Industry: Energy & Utilitiesllm

Discovered: Jun 4, 2016
Materiality determined: —
Notification sent: Aug 18, 2016
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: Providing notice to other regulators as necessary
Initial access: insider_action

During the incident: Began mailing notice letter to individuals
Assessing its policies, procedures, and technological safeguards relating to data privacy and network security
Implementing additional protections
Providing additional training on safeguarding the privacy and security of information
Internal technology department is investigating the incident
Providing affected individuals access to one year of free credit monitoring and identity theft restoration services through Experian
Providing notice to other regulators as necessary
Changes made: Implementing additional protections
Providing additional training on safeguarding the privacy and security of information in Chevron’s systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/chevron-20161012.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 12, 2016
Raw hash: f0908ac476844f27f2aff30ee1c50692ec5903a09e0b881f2a224a17c14762d5

Reporting entityMullen Coughlin LLC

Victim entityChevron Corporation

Incidentdiscovered Jun 4, 2016

Stated responseBegan mailing notice letter to individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov