HackingFinanceGovernment IDPIIMediumContained

HSBC Card and Retail Services and HSBC Bank Nevada, N.A.

bd_409f71fd4684955a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 25, 2008

To disclose

—

Affected

19state residents only

Confidence

65%

HSBC Card and Retail Services and HSBC Bank Nevada, N.A. notified the New Hampshire Attorney General on April 25, 2008, of a security incident involving its website's 'Forgot Login Password' page. Unauthorized third parties exploited a scripting vulnerability to view account information using account numbers and the last four digits of Social Security numbers. The incident affected 19 New Hampshire residents. HSBC strengthened authentication, issued new account numbers, and provided one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Apr 25, 2008

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed19 affectedView incident

Name: HSBC Card and Retail Services and HSBC Bank Nevada, N.A.
norm: hsbc card and retail services hsbc bank nevada

Name: HSBC Card and Retail Services and HSBC Bank Nevada, N.A.
norm: hsbc card and retail services hsbc bank nevada

Discovered: —
Materiality determined: —
Notification sent: Apr 14, 2008
Affected individuals: 19state-resident count only
Data types: Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: HSBC has taken a number of actions to strengthen the authentication process of the relevant web site
Issued you a new Account number
Extend to you a complimentary one-year membership in PrivacyGuard
Changes made: Strengthen the authentication process of the relevant web site
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hsbc-20080425.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2008
Raw hash: 80b02e988bc542d723915255e2d16646a84fad1601a6c407117d35f37e8b2088

Reporting entityHSBC Card and Retail Services and HSBC Bank Nevada, N.A.

Victim entityHSBC Card and Retail Services and HSBC Bank Nevada, N.A.

IncidentUnauthorized Access

Stated responseHSBC has taken a number of actions to strengthen the authentication process of the relevant web site

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov