HackingTechnologyInformationStolen CredentialsData ExfiltratedEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

CITRIX SYSTEMS, INC.

bd_33705d2dc689cf65 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 6, 2019

Filed

Apr 30, 2019

To disclose

8 weeks

Affected

90state residents only

Linked

3 filings

Confidence

66%

Full breach record for CITRIX SYSTEMS, INC. →2 incidents on file

Citrix Systems, Inc. notified New Hampshire residents that international cyber criminals gained access to its internal network between October 13, 2018 and March 8, 2019. The FBI informed Citrix on March 6, 2019. Files containing employee PII (names, SSNs, financial info) were removed. 90 NH residents were notified on April 29, 2019. Citrix reset passwords, enhanced MFA, and engaged forensic firms.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 144 days

discovery → filing · 8 weeks / 55 days

Oct 13, 2018

Begins

Mar 6, 2019

Discovered

Apr 30, 2019

Filed

vs. sector median

11 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_1596488bc59a7f4e2019-04-29 · +1dCandidate
California State AGbd_8da1d26120801d862019-04-29 · +1dVerified

Name: CITRIX SYSTEMS, INC.
norm: citrix systems

Name: CITRIX SYSTEMS, INC.
norm: citrix systems
Industry: Technologyllm

Discovered: Mar 6, 2019
Breach occurred: Oct 13, 2018 – Mar 8, 2019
Undetected for: 144 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 29, 2019
Affected individuals: 90state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Cooperating with the FBI
Initial access: valid_credentials

During the incident: Engaged leading cyber security firms to assist with forensic investigation
Cooperating with the FBI in connection with their investigation
System wide password reset
Tightened rules related to password complexity
Enhanced multifactor authentication on systems
Actively monitoring for signs of further activity or compromise
Changes made: Investing in resources and technology to improve internal security
Conducting comprehensive review of security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGApr 29 · first

California State AGApr 29 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/citrix-systems-20190430.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 30, 2019
Raw hash: 87cf0d2859bdffce67f4f277dc442126a433a9967971a77c875a306f52d36887

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCITRIX SYSTEMS, INC.

Victim entityCITRIX SYSTEMS, INC.

Incidentdiscovered Mar 6, 2019

Stated responseEngaged leading cyber security firms to assist with forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov