PhysicalProfessional ServicesProfessional ServicesTheftCustomer Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

GfK NOP, LLC

bd_37ea70569350622b · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 29, 2007

Filed

Jun 29, 2007

To disclose

4 weeks

Affected

Not disclosed

Confidence

65%

GfK NOP, LLC (d/b/a GfK Custom Research North America) reported the theft of a company-owned laptop on May 29, 2007, containing password-protected files with employee PII including SSNs, names, addresses, and payroll data. Notices were mailed to affected employees around June 12, 2007. No evidence of data access was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 31 days

May 29, 2007

Begins

May 29, 2007

Discovered

Jun 29, 2007

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: GfK NOP, LLC
norm: gfk nop
Domain: gfkamerica.com

Name: GfK NOP, LLC
norm: gfk nop
Domain: gfkamerica.com
Industry: Professional Servicesllm

Discovered: May 29, 2007
Breach occurred: May 29, 2007
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 12, 2007
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General, State of New Hampshire

During the incident: Local law enforcement was notified of the theft of the computer and of the personal information that was contained in some of the computer files
The attached notification was sent by regular mail to all affected employees
Changes made: Exploring new ways to safeguard as well as minimize the use of your personal data to prevent possible security breaches in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/gfk-custom-research-20070629.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 29, 2007
Raw hash: 2708e3973ad86b23cd3f87c7c0fdec4aaa1bddc912c66b53e01f7f9fe283a865

Reporting entityGfK NOP, LLC

Victim entityGfK NOP, LLC

Incidentdiscovered May 29, 2007

Stated responseLocal law enforcement was notified of the theft of the computer and of the personal information that was contained in some of the computer files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov