Social EngineeringRetail & ConsumerRetailPhishingData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

UniFirst Corporation

bd_1f76b095d45dc001 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2020

Filed

Nov 17, 2020

To disclose

7 weeks

Affected

10state residents only

Linked

4 filings

Confidence

66%

Full breach record for UniFirst Corporation →2 incidents on file

UniFirst Corporation notified the New Hampshire Attorney General of a data security incident occurring on or around September 28, 2020. An unauthorized party gained access to employee email inboxes via a phishing attack, potentially viewing names, Social Security numbers, and dates of birth. UniFirst discovered the breach on September 29, 2020, contained access, and notified 10 New Hampshire residents on October 13, 2020. Remediation included forensic analysis and 24 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 7 weeks / 49 days

Sep 28, 2020

Begins

Sep 29, 2020

Discovered

Nov 17, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_3e41237cc6986a542020-11-24 · +7dVerified
Maine State AGbd_92a843a8aee703872020-11-24 · +7dCandidate
Indiana State AGbd_66245929e6b882c62020-10-13 · +35dVerified

Name: GOODWIN PROCTER LLP
norm: goodwin procter
Domain: goodwinlaw.com

Name: UniFirst Corporation
norm: unifirst
Industry: Retail & Consumerllm

Discovered: Sep 29, 2020
Breach occurred: Sep 28, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 13, 2020
Affected individuals: 10state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the New Hampshire Attorney General
Initial access: phishing_link

During the incident: Shut down the access on September 29, 2020
Engaged with a forensic company to conduct a detailed analysis on the compromised mailbox
Notified the residents
Recommended actions they can take to protect themselves, such as monitoring account statements, obtaining credit reports, and instituting a security freeze on their credit files
Made available 24 months of identity protection services from Privacy Armor by InfoArmor, at no cost to the individual
Changes made: Undertaking a review of its systems to help guard against a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 13 · first

New Hampshire State AG+35d · this page

Massachusetts State AG+42d

Maine State AG+42d

Pattern: first filing Oct 13 (IN), last Nov 24 (ME) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/unifirst-20201117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2020
Raw hash: 91aedc93a0a1897037ba3ad3f4e7eba005870abc87aaeea25681db9d293c4a3c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityGOODWIN PROCTER LLP

Victim entityUniFirst Corporation

Incidentdiscovered Sep 29, 2020

Stated responseShut down the access on September 29, 2020

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov