Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)CredentialsLowContained

ABM INDUSTRIES INCORPORATED

bd_4452e36ce387df0a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 14, 2018

Filed

Jul 19, 2019

To disclose

13 months

Affected

13state residents only

Linked

2 filings

Confidence

65%

Full breach record for ABM INDUSTRIES INCORPORATED →6 incidents on file

ABM Industries Incorporated notified Montana residents of a phishing attack that compromised employee email accounts. Unauthorized access occurred between January 8, 2018, and August 7, 2018. The incident involved access to personal information of customers and employees. ABM secured accounts, engaged Kroll for forensic investigation and identity monitoring services, and implemented MFA and enhanced security training.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 157 days

discovery → filing · 13 months / 400 days

Jan 8, 2018

Begins

Jun 14, 2018

Discovered

Jul 19, 2019

Filed

vs. sector median

+39 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_5d2a4cee2573c4182019-07-23 · +4dVerified

Name: ABM INDUSTRIES INCORPORATED
norm: abm industries

Name: ABM INDUSTRIES INCORPORATED
norm: abm industries
Industry: Professional Servicesllm

Discovered: Jun 14, 2018
Breach occurred: Jan 8, 2018 – Aug 7, 2018
Undetected for: 157 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 19, 2019
Affected individuals: 13state-resident count only
Data types: PIIIdentity (basic)Credentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Provided notice to law enforcementProvided notice to certain regulators
Initial access: phishing_link

During the incident: Secured the affected email accounts
Retained a leading forensic investigation firm to assist with the investigation
Reviewed the contents of the accounts through an in-depth manual and programmatic process
Provided notice to law enforcement, certain regulators and consumer reporting agencies
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Employed the use of malware detection software
Implemented new technology, such as multi-factor authentication
Implemented third-party managed security services, with coverage 24 hours per day, 7 days per week
Provided company-wide anti-phishing and cyber-security training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(400 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGJul 19 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-ABM-Notice-of-Data-Event-MT.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 19, 2019
Raw hash: 69073511cd6e13a2db46e98f27b0f649f3f5a3a9e51971922f61d9b7c507b94a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityABM INDUSTRIES INCORPORATED

Victim entityABM INDUSTRIES INCORPORATED

Incidentdiscovered Jun 14, 2018

Stated responseSecured the affected email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov