HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)EmploymentLowContained

JobScience

bd_3694221f5c0eaacc · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 21, 2018

Filed

Apr 8, 2019

To disclose

33 weeks

Affected

501state residents only

Linked

5 filings

Confidence

67%

Full breach record for JobScience →

Jobscience, Inc. notified the NH AG of a data breach where an unauthorized third party accessed a legacy TalentPath server and exfiltrated data. The FBI observed the exfiltration in August 2018 and provided data to Jobscience on August 21, 2018, confirming the breach. Affected data includes PII of job applicants (employment records). 501 NH residents were notified. Jobscience engaged forensic auditors, patched the server, reset passwords, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 33 weeks / 230 days

Aug 21, 2018

Discovered

Apr 8, 2019

Filed

vs. sector median

+14 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_63a6bfe8e9a42bae2019-04-10 · +2dVerified
Massachusetts State AGbd_d8a9989d7c2c97032019-04-11 · +3dVerified
Montana State AGbd_86cde52f2976b5752019-04-05 · +3dVerified
Washington State AGbd_41ddfedcd0bb1e5f2019-04-03 · +5dCandidate

Name: JobScience
norm: jobscience
Domain: jobscience.cc

Name: JobScience
norm: jobscience
Domain: jobscience.cc
Industry: Technologyllm

Discovered: Aug 21, 2018
Materiality determined: —
Notification sent: Apr 4, 2019
Affected individuals: 501state-resident count only
Data types: PIIIdentity (basic)Employment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified FBI in August 2018
Initial access: exploit_public_facing

During the incident: Retained outside forensic auditors to conduct an independent review
Notified all customers that had information in the implicated server about the Attack on August 28, 2018
Deployed a patched version of the server and migrated all of its customers to the patched server
Updated user credentials by forcing all administrators and users to update their passwords
Retained a database consultant to analyze the data exfiltrated in the Attack
Changes made: Offering identity theft protection, including credit monitoring services, for 12 months to all notified individuals at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(230 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Washington State AGApr 3 · first

Montana State AG+2d

New Hampshire State AG+5d · this page

California State AG+7d

Massachusetts State AG+8d

Pattern: first filing Apr 3 (WA), last Apr 11 (MA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jobscience-inc-20190408.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2019
Raw hash: 30455abc554df58723caa53ba4bad0ca9e1b2decbf663fbadf60454bc31c71c7

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityJobScience

Victim entityJobScience

Incidentdiscovered Aug 21, 2018

Stated responseRetained outside forensic auditors to conduct an independent review

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov