Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumResolved

ABM INDUSTRIES INCORPORATED

bd_2d13cf7462eba6d8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 14, 2018

Filed

Mar 12, 2019

To disclose

39 weeks

Affected

846state residents only

Linked

6 filings

Confidence

69%

Full breach record for ABM INDUSTRIES INCORPORATED →6 incidents on file

ABM Industries Incorporated filed a supplemental notice with the Washington Attorney General regarding a phishing incident. Unauthorized access to employee email accounts occurred from January 8, 2018, to August 7, 2018. The breach exposed personal information of 846 Washington residents, including SSNs, driver's licenses, financial account numbers, and medical information. ABM engaged forensic experts, reset credentials, notified law enforcement, and provided one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 157 days

discovery → filing · 39 weeks / 271 days

Jan 8, 2018

Begins

Jun 14, 2018

Discovered

Mar 12, 2019

Filed

vs. sector median

+21 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_9a61b5d2d310a0dd2019-03-12Verified
Massachusetts State AGbd_a10bb6a035eb72d82019-03-12Verified
Oregon State AGbd_ab44d9f2f161fbe72019-03-12Verified
South Carolina State AGbd_1fbcc407c43af3f12019-03-18 · +6dVerified

Show 1 more filing ↓up to 7d gap

New Hampshire State AGbd_c4c524cdc6259a5e2019-03-19 · +7dVerified

Name: ABM INDUSTRIES INCORPORATED
norm: abm industries

Name: ABM INDUSTRIES INCORPORATED
norm: abm industries
Industry: Professional Servicesllm

Discovered: Jun 14, 2018
Breach occurred: Jan 8, 2018 – Aug 7, 2018
Undetected for: 157 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 29, 2019
Affected individuals: 846state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 200-299d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: phishing_link

During the incident: Engaged computer forensics experts
Reset passwords for ABM email accounts
Notified law enforcement
Provided relevant regulatory notices
Provided notification to the three major credit reporting agencies
Provided access to identity protection and credit monitoring services for one year through Kroll
Changes made: Reviewed existing policies and procedures
Implemented multi-factor authentication
Implemented third-party managed security services
Provided company-wide anti-phishing and cyber-security training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(271 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGMar 12 · first

Massachusetts State AGMar 12 · first

Oregon State AGMar 12 · first

Washington State AGMar 12 · first · this page

South Carolina State AG+6d

New Hampshire State AG+7d

Pattern: first filing Mar 12 (CA), last Mar 19 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10618.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2019
Raw hash: a0889653a1507f3e16d32906bf5c11d0dce7aa2faa6e76fdaabdd1ac349427fd

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityABM INDUSTRIES INCORPORATED

Victim entityABM INDUSTRIES INCORPORATED

Incidentdiscovered Jun 14, 2018

Stated responseEngaged computer forensics experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com