Social EngineeringTechnologyProfessional ServicesInformationPhishingEmployee Data InvolvedData ExfiltratedIdentity (basic)Government IDEmploymentMediumContained

NTT DATA Services, LLC

bd_3b55180960a9d623 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 22, 2016

Filed

May 4, 2016

To disclose

12 days

Affected

1state residents only

Linked

2 filings

Confidence

65%

Full breach record for NTT DATA Services, LLC →

NTT DATA, Inc. suffered a phishing incident on April 22, 2016, where an employee unwittingly sent W-2 information (names, addresses, SSNs, earnings) for one New Hampshire resident to an unknown third party. The company notified the NH Attorney General, FBI, and IRS. Credit monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 days

Apr 22, 2016

Begins

Apr 22, 2016

Discovered

May 4, 2016

Filed

vs. sector median

17 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c50e1e9d71475c6e2016-05-09 · +5dVerified

Name: NTT DATA Services, LLC
norm: ntt data
Domain: careers.services.global.ntt

Name: NTT DATA Services, LLC
norm: ntt data
Domain: careers.services.global.ntt
Industry: TechnologyllmProfessional Servicesllm

Discovered: Apr 22, 2016
Breach occurred: Apr 22, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 4, 2016
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General, State of New HampshireNotified the FBI Internet Criminal Complaint CenterNotified the Internal Revenue Service
Initial access: phishing_link

During the incident: Notified the FBI Internet Criminal Complaint Center and filed a case with them
Contacted the Internal Revenue Service civil and criminal divisions to alert them to the theft
Notified the three Consumer Reporting Agencies of this incident
Offering two (2) years of credit monitoring and identity theft services for the affected individuals through Experian
Notified all individuals whose information was exposed
Changes made: Taking steps internally to improve our procedures for protecting data so that this type of incident does not recur
Implementing access and storage restrictions
Implementing enhanced transmission procedures
Conducting an intensive internal audit and remediation plan
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMay 4 · first · this page

Massachusetts State AG+5d

Pattern: first filing May 4 (NH), last May 9 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ntt-data-20160504.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 4, 2016
Raw hash: 3d9325ac27d45bcf32caede603daa72d017ede878c8d6f3f63ef590fc266dcff

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNTT DATA Services, LLC

Victim entityNTT DATA Services, LLC

Incidentdiscovered Apr 22, 2016

Stated responseNotified the FBI Internet Criminal Complaint Center and filed a case with them

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov