AccidentalHealthcareManufacturingHealthcareLossCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancialMediumActive

ABBOTT LABORATORIES

bd_40c8535529672bd5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 19, 2019

Filed

Feb 5, 2019

To disclose

17 days

Affected

50state residents only

Linked

4 filings

Confidence

66%

Full breach record for ABBOTT LABORATORIES →3 incidents on file

Abbott Laboratories notified the NH AG of a data incident involving a misplaced portable drive held by a third-party auditor. The drive contained employee PII (SSN, DOB, stock info) for approx 50 NH residents. Incident discovered Jan 19, 2019. Notifications sent Feb 6, 2019. Identity protection services provided.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 10 days

discovery → filing · 17 days

Jan 9, 2019

Begins

Jan 19, 2019

Discovered

Feb 5, 2019

Filed

vs. sector median

9 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_4a8d276eef928ef62019-02-05Verified
Massachusetts State AGbd_6914ee3dc136d1dd2019-02-05Verified
Montana State AGbd_09adab384bda12682019-02-06 · +1dCandidate

Name: WilmerHale
norm: wilmerhale

Name: ABBOTT LABORATORIES
norm: abbott laboratories
Domain: abbott.com
Industry: HealthcarellmManufacturingllm

Discovered: Jan 19, 2019
Breach occurred: Jan 9, 2019 – Jan 19, 2019
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 6, 2019
Affected individuals: 50state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Partner
Regulator citations: Notified New Hampshire Attorney General

During the incident: Began an investigation into the actions of the auditor and circumstances leading to the loss of the drive
Conducted a thorough review of the affected records to identify impacted individuals
Prepared notifications about this incident to be mailed to affected individuals
Arranged for a third party to provide identity protection services to affected individuals for 24 months
Changes made: Reassessing its own internal controls and the controls of its third-party auditor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGFeb 5 · first

Massachusetts State AGFeb 5 · first

New Hampshire State AGFeb 5 · first · this page

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/abbott-laboratories-20190205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 5, 2019
Raw hash: afb348bbfecb4c6e08f648ca9b6584cf4e741e59b9e0bd24d3c27ef70599194d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWilmerHale

Victim entityABBOTT LABORATORIES

Incidentdiscovered Jan 19, 2019

Stated responseBegan an investigation into the actions of the auditor and circumstances leading to the loss of the drive

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov