PhysicalProfessional ServicesProfessional ServicesTheftCustomer Data InvolvedGovernment IDIdentity (basic)MediumResolved

Carmichael

bd_4628bb9f717ffc28 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 6, 2012

Filed

Sep 11, 2012

To disclose

5 days

Affected

Not disclosed

Confidence

66%

Full breach record for Carmichael →

Carmichael Company notified clients that an electronic filing report containing names and Social Security numbers was found by the U.S. Postal Inspection Service in a raid on a criminal. The company confirmed the list originated from its office on September 6, 2012, but does not have a specific date for the unauthorized release. The company ceased producing such lists and recommended clients place fraud alerts on their credit files.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 days

Sep 6, 2012

Discovered

Sep 11, 2012

Filed

vs. sector median

17 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Carmichael
norm: carmichael
Domain: carmichaelnl.com

Name: Carmichael
norm: carmichael
Domain: carmichaelnl.com
Industry: Professional Servicesllm

Discovered: Sep 6, 2012
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External

During the incident: Changed procedure so we no longer produce such a list
Recommended that you place a fraud alert on your credit file
Changes made: Changed procedure so we no longer produce such a list
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-36425
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2012
Raw hash: 57e5e6fb567d9f1c4644c6b3b4bfa8b9ba4f70dcf0c62b9682524bc798218e81

Reporting entityCarmichael

Victim entityCarmichael

Incidentdiscovered Sep 6, 2012

Stated responseChanged procedure so we no longer produce such a list

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov