AccidentalGovernmentGovernmentMisconfigurationCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)MediumContained

Salt Lake County, Utah

bd_3a75c1fcda487508 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 9, 2015

Filed

Oct 9, 2015

To disclose

4 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Salt Lake County, Utah →

Salt Lake County, Utah notified the NH AG of a security incident discovered Sept 9, 2015, caused by a vendor's misconfiguration on June 18, 2015. The error exposed claimant PII (name, address, SSN, limited medical info) to the internet. Two NH residents were affected. Notifications sent Oct 9, 2015, including credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 83 days

discovery → filing · 4 weeks / 30 days

Jun 18, 2015

Begins

Sep 9, 2015

Discovered

Oct 9, 2015

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_774deb24ec0b26282015-10-09Candidate
Massachusetts State AGbd_ebb443350266c6762015-10-14 · +5dVerified

Name: Salt Lake County, Utah
norm: salt lake county utah

Name: Salt Lake County, Utah
norm: salt lake county utah
Industry: Governmentllm

Discovered: Sep 9, 2015
Breach occurred: Jun 18, 2015 – Sep 9, 2015
Undetected for: 83 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 9, 2015
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: cooperating with law enforcement

During the incident: Began an investigation into the situation
Restored all proper security settings
Cooperating with law enforcement
Offering potentially impacted individuals with credit monitoring and identity restoration services through IDT 911
Changes made: Ensuring that vendors hired by the County have adequate security oversight procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGOct 9 · first

New Hampshire State AGOct 9 · first · this page

Massachusetts State AG+5d

Pattern: first filing Oct 9 (MT), last Oct 14 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/salt-lake-city-20151009.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2015
Raw hash: d4aa76770db1437a98049dae51887308cee16d38705658b70f559b27ac4f6a2a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySalt Lake County, Utah

Victim entitySalt Lake County, Utah

Incidentdiscovered Sep 9, 2015

Stated responseBegan an investigation into the situation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov