HackingManufacturingTechnologyManufacturingVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIMediumContained

Prysmian Cables and Systems USA, LLC

bd_3c1f3df26f6d2d0c · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 1, 2022

Filed

Jul 7, 2022

To disclose

10 weeks

Affected · nationwide

5645 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Prysmian Cables and Systems USA, LLC →

Prysmian Cables and Systems USA, LLC reported a data incident involving its third-party broker Aon PLC. An unauthorized third party exploited a zero-day vulnerability to access Aon systems between Dec 29, 2020, and Feb 25, 2022. Personal information of 564 current/former employees, including SSNs and health plan data, was temporarily obtained. Prysmian notified affected individuals on July 5, 2022, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 488 days

discovery → filing · 10 weeks / 67 days

Dec 29, 2020

Begins

May 1, 2022

Discovered

Jul 7, 2022

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_20062bf2bd8414952022-07-07Verified
Indiana State AGbd_4605fbf9ba41a66c2022-07-05 · +2dVerified

Name: Prysmian Cables and Systems USA, LLC
norm: prysmian cables and systems usa
Domain: prysmiangroup.com

Name: Prysmian Cables and Systems USA, LLC
norm: prysmian cables and systems usa
Domain: prysmiangroup.com
Also named: Prysmian Cables and Systems USA, LLCdba oflegal entity
Prysmian Groupdba oftrade name
Industry: ManufacturingllmTechnologyllm

Discovered: May 1, 2022
Breach occurred: Dec 29, 2020 – Feb 25, 2022
Undetected for: 488 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 5, 2022
Affected individuals: 564state + nationwide
Data types: Identity (basic)Government IDPHI
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's OfficeReported incident to FBI
Third party: via Aon PLC
Initial access: exploit_public_facing

During the incident: Retained leading cybersecurity firms to assist in responding and to help conduct a thorough investigation
Reported the incident to, and is working closely with, the FBI
Provided access to complimentary credit monitoring services for 24 months, through Experian
Undertaking a review of its processes for sharing employee information with its vendors
Changes made: Reviewing its processes for sharing employee information with its vendors to assure the information’s security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJul 5 · first

Massachusetts State AG+2d

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/prysmian-cables-systems-usa-dba-prysmian-group-20220707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2022
Raw hash: d97c31ffe5290f9f2cf90a77a74949582c7c0ec0752ef2a2edf5d6e5c0cf3b5b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPrysmian Cables and Systems USA, LLC

Victim entityPrysmian Cables and Systems USA, LLC

Incidentdiscovered May 1, 2022

Stated responseRetained leading cybersecurity firms to assist in responding and to help conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov