HackingTechnologyProfessional ServicesInformationStolen CredentialsData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

LexisNexis Risk Solutions FL Inc.

bd_451d828712208c56 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 9, 2011

Filed

May 9, 2011

To disclose

≤1 day

Affected

74state residents only

Confidence

66%

Full breach record for LexisNexis Risk Solutions FL Inc. →4 incidents on file

LexisNexis Risk Solutions notified the NH Attorney General of a breach involving third-party vendor Onyx Collections. Between Sept 2009 and March 2011, Onyx accessed PII including SSNs and driver's licenses. LexisNexis discovered the risk via audit, delayed notice for law enforcement, and is offering 1 year of credit monitoring to 74 NH residents and others nationwide.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 606 days

discovery → filing · ≤1 day / 0 days

Sep 10, 2009

Begins

May 9, 2011

Discovered

May 9, 2011

Filed

vs. sector median

19 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed74 affectedView incident

Name: LexisNexis Risk Solutions FL Inc.
norm: lexisnexis risk solutions fl
Domain: risk.lexisnexis.com

Name: LexisNexis Risk Solutions FL Inc.
norm: lexisnexis risk solutions fl
Domain: risk.lexisnexis.com
Industry: TechnologyllmProfessional Servicesllm

Discovered: May 9, 2011
Breach occurred: Sep 10, 2009 – Mar 2, 2011
Undetected for: 606 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 9, 2011
Affected individuals: 74state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralWorking with federal law enforcement
Third party: via Onyx Collections & Locators Services Inc.
Initial access: trusted_relationship

During the incident: Working with federal law enforcement to further investigate this matter
Offering potentially affected consumers one year of free credit monitoring
Arranged for a specially trained support team to assist consumers
Changes made: Implementation of a standards-based security control framework
Prospective customers must undergo a process of verification or credentialing
Implemented numerous policies, procedures and standards for data governance
Maintains a robust audit and compliance program
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lexisnexis-20110509.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2011
Raw hash: e767655ab85b54a4ff5265d69542e2ce75a114590acbc8e1423de4f894215c02

Reporting entityLexisNexis Risk Solutions FL Inc.

Victim entityLexisNexis Risk Solutions FL Inc.

Incidentdiscovered May 9, 2011

Stated responseWorking with federal law enforcement to further investigate this matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov