AccidentalGovernmentGovernmentMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancialHighResolved

New Hampshire Department of Employment Security

bd_290ea77bb4ea80ab · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 12, 2014

Filed

Nov 25, 2014

To disclose

13 days

Affected

2,703state residents only

Confidence

66%

Full breach record for New Hampshire Department of Employment Security →2 incidents on file

The New Hampshire Department of Employment Security (NHES) inadvertently mailed monthly charging statements to employers containing personally identifiable information (names, SSNs, benefit amounts) of claimants who had not worked for those employers. The error, caused by a scheduling software issue, affected 2,703 claimants. NHES notified affected individuals and employers, required destruction of the erroneous documents, and deleted the online statements.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 days

Nov 12, 2014

Begins

Nov 12, 2014

Discovered

Nov 25, 2014

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,703 affectedView incident

Name: New Hampshire Department of Employment Security
norm: new hampshire department of employment security
Domain: nhes.nh.gov

Name: New Hampshire Department of Employment Security
norm: new hampshire department of employment security
Domain: nhes.nh.gov
Industry: Governmentllm

Discovered: Nov 12, 2014
Breach occurred: Nov 12, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 24, 2014
Affected individuals: 2,703state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security numberDate of birth
Attack vector: Unknown
Regulator citations: Notified the New Hampshire Department of Justice pursuant to RSA 359-C:20Notified all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis

During the incident: Notified all recipients of the information and instructed them to delete the document
Required each recipient to return a signed statement verifying that the document containing the information has been destroyed
Deleted the erroneous on-line statement from the NHUIS correspondence box
Generated and mailed accurate October statements
Changes made: Carefully reviewing internal procedures regarding the mailing of the monthly statements to ensure there is no reoccurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nh-employment-security-20141125.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 25, 2014
Raw hash: 4133229d80078008fb412803d88ba46d38ca1e37ce1f94130e1d9565260a74aa

Reporting entityNew Hampshire Department of Employment Security

Victim entityNew Hampshire Department of Employment Security

Incidentdiscovered Nov 12, 2014

Stated responseNotified all recipients of the information and instructed them to delete the document

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov