AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

OPPENHEIMERFUNDS, INC.

bd_32622c809e13eef7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 23, 2014

Filed

Aug 1, 2014

To disclose

9 days

Affected

Not disclosed

Confidence

65%

Full breach record for OPPENHEIMERFUNDS, INC. →7 incidents on file

Oppenheimer Funds notified the NH DOJ that a brokerage firm erroneously accessed the names, account numbers, and SSNs of NH shareholders on July 22, 2014. Oppenheimer resolved the error on July 23, 2014, and notified affected individuals on July 30, 2014, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 9 days

Jul 22, 2014

Begins

Jul 23, 2014

Discovered

Aug 1, 2014

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: OPPENHEIMERFUNDS, INC.
norm: oppenheimerfunds
Domain: oppenheimerfunds.com

Name: OPPENHEIMERFUNDS, INC.
norm: oppenheimerfunds
Domain: oppenheimerfunds.com
Industry: Financial Servicesllm

Discovered: Jul 23, 2014
Breach occurred: Jul 22, 2014
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jul 30, 2014
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Initial access: trusted_relationship

During the incident: Resolved the issue that caused this error on the same day we were notified
Notifying Shareholders of this incident
Notifying the three major credit reporting agencies (i.e., Equifax, Experian, and Trans Union)
Changes made: Offering credit protection through Equifax Consumer Services, LLC at the expense of OppenheimerFunds
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/oppenheimer-funds-20140801.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 1, 2014
Raw hash: 1027231845aa4e7e3d2ca03e668a42fa7214a2159c1dfe60d79ae4c90616c088

Reporting entityOPPENHEIMERFUNDS, INC.

Victim entityOPPENHEIMERFUNDS, INC.

Incidentdiscovered Jul 23, 2014

Stated responseResolved the issue that caused this error on the same day we were notified

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov