AccidentalProfessional ServicesProfessional ServicesMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

Worthy Publishing

bd_45e3965ff49c2e6e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 4, 2019

Filed

Feb 25, 2019

To disclose

21 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Worthy Publishing →

Worthy Publishing, a division of Hachette Book Group, Inc., disclosed that 1099-MISC tax forms containing personal information (names, addresses, SSNs/TINs, financial data) were inadvertently mailed to incorrect recipients due to confusion during a former employee's transition. The incident was discovered on February 4, 2019. One New Hampshire resident was affected. The company investigated, notified affected individuals on February 22, 2019, and provided 24 months of credit monitoring and identity protection services. Processes for transmitting sensitive information are being formalized.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 days

Feb 4, 2019

Begins

Feb 4, 2019

Discovered

Feb 25, 2019

Filed

vs. sector median

15 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_e4f0cafa70efb6a72019-02-25Verified

Name: Worthy
norm: worthy
Domain: worthy.com

Name: Worthy Publishing
norm: worthy publishing
Industry: Professional Servicesllm

Discovered: Feb 4, 2019
Breach occurred: Feb 4, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 22, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified the Office of the Attorney General of New Hampshire

During the incident: Immediately investigated the incident to determine what happened
Sent written notice by U.S. mail to impacted individuals on February 22, 2019
Provided 24 months of credit monitoring and identity protection services to affected consumers through AllClear Identity Repair and AllClear Fraud Alerts with Credit Monitoring
Changes made: Formalizing many of our processes, including the transmittal of sensitive information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGFeb 25 · first

New Hampshire State AGFeb 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/worthy-publishing-20190225.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2019
Raw hash: 951fd43fe002456bcb7877d91a19e8c090ab788252c95f803b6291bfc26d0f2f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWorthy

Victim entityWorthy Publishing

Incidentdiscovered Feb 4, 2019

Stated responseImmediately investigated the incident to determine what happened

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov