MisuseTechnologyInformationPrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDMediumActive

Rakuten USA, Inc.

bd_3748bb1494a21cbc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 21, 2021

Filed

Feb 18, 2021

To disclose

28 days

Affected

9state residents only

Linked

6 filings

Confidence

67%

Full breach record for Rakuten USA, Inc. →

Rakuten USA, Inc. notified the New Hampshire Attorney General of a data event involving an departing employee who transferred files containing sensitive personal information (names, SSNs, DOBs) of other employees. Nine NH residents were affected. Rakuten deleted copies from the employee's personal device, engaged law enforcement, and provided two years of credit monitoring. Investigation was ongoing as of February 11, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 28 days

Jan 21, 2021

Discovered

Feb 18, 2021

Filed

vs. sector median

15 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_3174790e2060a4d92021-02-11 · +7dVerified
Massachusetts State AGbd_57c9021e9307b3f72021-02-11 · +7dVerified
Montana State AGbd_5b9c71cefac703172021-02-11 · +7dCandidate
Maine State AGbd_d667a4564196f04a2021-02-11 · +7dVerified

Show 1 more filing ↓up to 14d gap

Indiana State AGbd_8175a8bc61f31f992021-02-04 · +14dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Rakuten USA, Inc.
norm: rakuten usa
Also named: Rakuten USA, Inc.dba oflegal entity
Rakuten Americasdba oftrade name
Industry: Technologyllm

Discovered: Jan 21, 2021
Materiality determined: —
Notification sent: Feb 11, 2021
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified Office of the New Hampshire Attorney GeneralRakuten has been in touch with law enforcement
Initial access: insider_action

During the incident: Rakuten launched an investigation into the nature and scope of their activity
Rakuten immediately took steps to limit potential further exposure of the data, including, during an interview with the employee, deleting copies of the files from a personal device and account where they were discovered
Rakuten has been in touch with law enforcement
Rakuten began providing written notice of this incident to individuals whose information has been determined to have been in the impacted files
Rakuten is providing access to credit monitoring services for two (2) years, through Epiq, to letter recipients, at no cost to these individuals
Rakuten is working to implement additional safeguards and training to its employees
Changes made: Working to implement additional safeguards and training to its employees
Reviewing our existing policies and procedures and will implement additional safeguards, as needed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGFeb 4 · first

California State AG+7d

Massachusetts State AG+7d

Montana State AG+7d

Maine State AG+7d

New Hampshire State AG+14d · this page

Pattern: first filing Feb 4 (IN), last Feb 18 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rakuten-usa-20210218.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 18, 2021
Raw hash: 757c9c553f65bb8e0fd540b11e7513e5949500fddfe243e51a1686b7b0998623

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityRakuten USA, Inc.

Incidentdiscovered Jan 21, 2021

Stated responseRakuten launched an investigation into the nature and scope of their activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov