MisuseFinancial ServicesFinanceData MishandlingEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

Dover Federal Credit Union

bd_3a8f52360bced411 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 20, 2016

Filed

Dec 22, 2016

To disclose

13 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Dover Federal Credit Union →

Dover Federal Credit Union notified members that an employee transferred files containing personal information (name, address, account number, SSN) to a personal Dropbox account for business purposes. The incident was discovered on September 20, 2016. Investigation concluded it was unlikely unauthorized persons accessed the data. The credit union updated security controls and offered identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 93 days

Sep 20, 2016

Begins

Sep 20, 2016

Discovered

Dec 22, 2016

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_759e7e83d07723b32016-12-22Verified
Montana State AGbd_79f7454d87adffd82016-12-22Candidate

Name: Dover Federal Credit Union
norm: dover federal credit union

Name: Dover Federal Credit Union
norm: dover federal credit union
Industry: Financial Servicesllm

Discovered: Sep 20, 2016
Breach occurred: Sep 20, 2016 – Nov 17, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Insider
Threat actor: Internal
Initial access: insider_action

During the incident: Hired a computer forensic firm to help investigate the incident
Offering a complimentary one-year membership of Experian’s ProtectMyID Alert
Changes made: Reviewed and updated existing security controls
Re-educated employees regarding handling customer information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 22 · first

Montana State AGDec 22 · first

California State AGDec 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-65580
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2016
Raw hash: 313a036f6ee3cb48991cea53076445dba94516ba075e4c541ed9a478fa545e00

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDover Federal Credit Union

Victim entityDover Federal Credit Union

Incidentdiscovered Sep 20, 2016

Stated responseHired a computer forensic firm to help investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov