Social EngineeringRetail & ConsumerRetailPhishingData ExfiltratedCustomer Data InvolvedPIIGovernment IDIdentity (basic)MediumContained

J. Polep Distribution Services

bd_3fcd9ef7ba2e39ab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 29, 2016

Filed

Aug 17, 2016

To disclose

19 days

Affected

19state residents only

Linked

2 filings

Confidence

67%

Full breach record for J. Polep Distribution Services →

J. Polep Distribution Services notified the New Hampshire Attorney General on August 17, 2016, of a phishing incident discovered on July 29, 2016. An email spoofing scam compromised 2015 W-2 forms for 19 New Hampshire residents, exposing names and Social Security numbers. The company notified the FBI and IRS, provided credit monitoring, and issued notices to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 days

Jul 29, 2016

Discovered

Aug 17, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_d14e3b908e4870e72016-08-17Verified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: J. Polep Distribution Services
norm: j polep distribution
Industry: Retail & Consumerllm

Discovered: Jul 29, 2016
Materiality determined: —
Notification sent: Aug 17, 2016
Affected individuals: 19state-resident count only
Data types: PIIGovernment IDIdentity (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI and IRS about this incidentProvided written notice of this incident to other state regulators as necessary
Initial access: phishing_link

During the incident: Provided notice of this incident, including information on how to better protect against identity theft and fraud
Provided information on how to place a fraud alert or security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on notifying the Federal Trade Commission
Provided information on notifying the state Attorney General
Provided information on how to notify law enforcement to report attempted or actual identity fraud
Provided affected individuals access to two (2) years of free credit monitoring and identity theft restoration services
Provided a call-line for potentially affected individuals to contact J. Polep with questions or concerns
Provided written notice of this incident to other state regulators as necessary
Notified the FBI and IRS about this incident
Changes made: Provided affected individuals access to two (2) years of free credit monitoring and identity theft restoration services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGAug 17 · first

New Hampshire State AGAug 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/j-polep-distribution-20160817.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2016
Raw hash: 8c164213be8bae7b65cb723d6bf23ed15044ca307982f61e62d72bb2d2de8086

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityJ. Polep Distribution Services

Incidentdiscovered Jul 29, 2016

Stated responseProvided notice of this incident, including information on how to better protect against identity theft and fraud

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov