Social EngineeringManufacturingTechnologyManufacturingPretextingData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Blue Belt Technologies

bd_2a33eafd102a29e1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 21, 2016

Filed

Mar 24, 2016

To disclose

3 days

Affected

1state residents only

Confidence

67%

Full breach record for Blue Belt Technologies →

Smith & Nephew PLC reported that Blue Belt Technologies, its subsidiary, was impacted by a data incident involving its former third-party payroll vendor, Dare Enterprises. A fraudulent scheme resulted in the mistaken release of W2 forms containing names, addresses, and SSNs. One New Hampshire resident was affected. Smith & Nephew notified the FBI, offered credit monitoring, and sent notices to impacted individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 3 days

Mar 21, 2016

Discovered

Mar 24, 2016

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: SMITH & NEPHEW, INC.
norm: smith nephew

Name: Blue Belt Technologies
norm: blue belt
Industry: ManufacturingllmTechnologyllm

Discovered: Mar 21, 2016
Materiality determined: —
Notification sent: Mar 24, 2016
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified FBIContacted IRS
Initial access: trusted_relationship

During the incident: Contacted the FBI and has been working and cooperating with them to further investigate the matter
Contacted the IRS regarding the security incident
Sent notice by email to impacted individuals on March 24, 2016
Sending a letter to impacted individuals with the unique redemption code and further details relating to the free credit monitoring
Offering 12 months of free credit monitoring services
Changes made: Offering 12 months of free credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 3 days(3 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/smith-nephew-20160324.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2016
Raw hash: ad12cff33378f31f0ce68e688b0b8b6de0ce546bd7814944bee8c92acece2ba7

Reporting entitySMITH & NEPHEW, INC.

Victim entityBlue Belt Technologies

Incidentdiscovered Mar 21, 2016

Stated responseContacted the FBI and has been working and cooperating with them to further investigate the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov