Social EngineeringTechnologyInformationPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

Actifio, Inc.

bd_45dd53254ea0ef1b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 16, 2016

Filed

Mar 2, 2016

To disclose

15 days

Affected

15state residents only

Confidence

66%

Full breach record for Actifio, Inc. →

Actifio, Inc. notified the New Hampshire Attorney General of a phishing attack on February 3, 2016, which resulted in the unauthorized acquisition of a spreadsheet containing payroll data for 15 New Hampshire residents. Data exposed included names, addresses, SSNs, dates of birth, and salaries. Actifio discovered the incident on February 16, 2016, and began notifying affected individuals on March 4, 2016, offering 12 months of credit monitoring and identity repair services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 15 days

Feb 3, 2016

Begins

Feb 16, 2016

Discovered

Mar 2, 2016

Filed

vs. sector median

16 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed15 affectedView incident

Name: Actifio, Inc.
norm: actifio

Name: Actifio, Inc.
norm: actifio
Industry: Technologyllm

Discovered: Feb 16, 2016
Breach occurred: Feb 3, 2016
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2016
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Preparing to notify the 15 residents of New Hampshire affected by the unauthorized access with a letter
Providing free identity theft monitoring as offered by AllClearID
Providing resources and guidance for dealing with identity theft and tax fraud
Changes made: Making arrangements for free credit watch monitoring and identity repair services over a 12 month period
Actively managing the incident and security practices for safeguarding payroll data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/actifio-20160302.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2016
Raw hash: 1a191f4b63c3076ee62b1fbba13f2aaf84b39587e9423518992b20f21b19a178

Reporting entityActifio, Inc.

Victim entityActifio, Inc.

Incidentdiscovered Feb 16, 2016

Stated responsePreparing to notify the 15 residents of New Hampshire affected by the unauthorized access with a letter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov