AccidentalConstructionConstructionMisdeliveryEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)MediumResolved

WillScot Mobile Mini Holdings Corp.

bd_3e99aa0aaf128eb0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 10, 2020

Filed

Nov 20, 2020

To disclose

10 days

Affected

23state residents only

Linked

5 filings

Confidence

66%

Full breach record for WillScot Mobile Mini Holdings Corp. →

WillScot Mobile Mini Holdings Corp. notified the NH Attorney General of an inadvertent email misdelivery on November 10, 2020. The Human Resources Department accidentally attached a spreadsheet containing sensitive employee information (names, addresses, DOBs, SSNs, health insurance Member IDs) to an email sent to managers. The email was deleted within minutes. 23 New Hampshire residents were affected. The company offered 24 months of credit monitoring and is retraining staff on email security.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 days

Nov 10, 2020

Begins

Nov 10, 2020

Discovered

Nov 20, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_5bcbecc37db6bbb82020-11-20Verified
Massachusetts State AGbd_415ac35d076f517b2020-11-19 · +1dVerified
Indiana State AGbd_ab8bda1225cf62f32020-11-19 · +1dVerified
Maine State AGbd_6beff7b12a9bd2b62020-11-11 · +9dCandidate

Name: WillScot Mobile Mini Holdings Corp.
norm: willscot mobile mini
Domain: foley.com

Name: WillScot Mobile Mini Holdings Corp.
norm: willscot mobile mini
Industry: Constructionllm

Discovered: Nov 10, 2020
Breach occurred: Nov 10, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2020
Affected individuals: 23state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified the New Hampshire Attorney General

During the incident: Deleted all copies of the email and related attachments from recipients' inboxes and computers within minutes of the message being delivered
Provided credit monitoring and identity protection services through Experian, at no charge for a period of twenty-four (24) months
Set up a dedicated support line that will be staffed to answer any questions individuals may have about this incident or the services available to them
Changes made: Retraining its workforce on email security best practices
Investigating other software solutions to help avoid an event like this from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGNov 11 · first

Massachusetts State AG+8d

Indiana State AG+8d

Montana State AG+9d

New Hampshire State AG+9d · this page

Pattern: first filing Nov 11 (ME), last Nov 20 (NH) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/willscot-mobile-mini-holdings-20201120.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 20, 2020
Raw hash: 5f2e27b64dd0b54446dc2a9207ffb4a677b1ff763a99e9b95bbd6f67b6288b41

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWillScot Mobile Mini Holdings Corp.

Victim entityWillScot Mobile Mini Holdings Corp.

Incidentdiscovered Nov 10, 2020

Stated responseDeleted all copies of the email and related attachments from recipients' inboxes and computers within minutes of the message being delivered

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov