Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)MediumContained

ABM INDUSTRIES INCORPORATED

bd_1fbcc407c43af3f1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 14, 2018

Filed

Mar 18, 2019

To disclose

40 weeks

Affected

4,868state residents only

Linked

6 filings

Confidence

63%

Full breach record for ABM INDUSTRIES INCORPORATED →6 incidents on file

ABM Industries Incorporated notified affected individuals of a phishing attack that compromised employee email accounts. Unauthorized access occurred between January 8, 2018, and August 7, 2018. The incident exposed personal information (names, addresses) of customers/clients stored in those emails. ABM secured accounts, engaged Kroll for forensics and identity monitoring, and implemented MFA and enhanced security services.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due40 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 157 days

discovery → filing · 40 weeks / 277 days

Jan 8, 2018

Begins

Jun 14, 2018

Discovered

Mar 18, 2019

Filed

vs. sector median

+20 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_c4c524cdc6259a5e2019-03-19 · +1dVerified
Washington State AGbd_2d13cf7462eba6d82019-03-12 · +6dCandidate
California State AGbd_9a61b5d2d310a0dd2019-03-12 · +6dVerified
Massachusetts State AGbd_a10bb6a035eb72d82019-03-12 · +6dVerified

Show 1 more filing ↓up to 6d gap

Oregon State AGbd_ab44d9f2f161fbe72019-03-12 · +6dVerified

Name: ABM INDUSTRIES INCORPORATED
norm: abm industries

Name: ABM INDUSTRIES INCORPORATED
norm: abm industries
Industry: Professional Servicesllm

Discovered: Jun 14, 2018
Breach occurred: Jan 8, 2018 – Aug 7, 2018
Undetected for: 157 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 1, 2019
Affected individuals: 4,868state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified law enforcementNotified certain regulatorsNotified consumer reporting agencies
Initial access: phishing_link

During the incident: Secured the affected email accounts
Retained Kroll to assist with the investigation
Reviewed the contents of the accounts through an in-depth manual and programmatic process
Confirmed the identities of the individuals who may have had information accessible
Launched a review of files to ascertain address information for impacted individuals
Provided notice to law enforcement, certain regulators and consumer reporting agencies
Offered one year of identity monitoring services through Kroll
Changes made: Employed the use of malware detection software
Implemented multi-factor authentication
Implemented third-party managed security services with 24/7 coverage
Provided company-wide anti-phishing and cyber-security training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(277 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGMar 12 · first

California State AGMar 12 · first

Massachusetts State AGMar 12 · first

Oregon State AGMar 12 · first

South Carolina State AG+6d · this page

New Hampshire State AG+7d

Pattern: first filing Mar 12 (WA), last Mar 19 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/ABMIndustriesIncorporated.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2019
Raw hash: 64a2a960092d5bc8c25e0f4ef2fc20e3e01f4017fa8dbfaf727d106d0c9a4454

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityABM INDUSTRIES INCORPORATED

Victim entityABM INDUSTRIES INCORPORATED

Incidentdiscovered Jun 14, 2018

Stated responseSecured the affected email accounts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov