HackingTechnologyFinancial ServicesInformationStolen CredentialsBECTargetedData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

BAMBOO HR LLC

bd_50e98d4020a8dbd3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 13, 2019

Filed

Mar 7, 2019

To disclose

22 days

Affected

6state residents only

Linked

4 filings

Confidence

66%

Full breach record for BAMBOO HR LLC →

Bamboo HR LLC reported unauthorized access to its TraxPayroll system starting Feb 5, 2019, discovered Feb 13, 2019. An external actor attempted to divert payroll deposits using valid credentials, accessing employee PII including SSNs and bank info. 6 NH residents affected. FBI notified, access cut, credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 22 days

Feb 5, 2019

Begins

Feb 13, 2019

Discovered

Mar 7, 2019

Filed

vs. sector median

16 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_fb050abdef17cc3b2019-03-05 · +2dVerified
Montana State AGbd_4349f3b33a4524b62019-03-04 · +3dCandidate
California State AGbd_5ad88fa8a11f63512019-02-28 · +7dVerified

Name: Holland & Hart LLP
norm: holland hart

Name: BAMBOO HR LLC
norm: bamboo hr
Industry: TechnologyllmFinancial Servicesllm

Discovered: Feb 13, 2019
Breach occurred: Feb 5, 2019 – Feb 13, 2019
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2019
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI
Initial access: valid_credentials

During the incident: Corrected all modified direct deposit information
Shut down the third party's access to BambooHR's TraxPayroll system
Notified the FBI of this incident
Implementing further security procedures
Changes made: Deploying additional security measures
Contracted with Experian to provide 12 months of free credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGFeb 28 · first

Montana State AG+4d

Massachusetts State AG+5d

New Hampshire State AG+7d · this page

Pattern: first filing Feb 28 (CA), last Mar 7 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bamboo-hr-20190307.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 7, 2019
Raw hash: 9530584b0350101e44c7860861c513b1c6d6b5f1d080f381b284a96e468d5069

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHolland & Hart LLP

Victim entityBAMBOO HR LLC

Incidentdiscovered Feb 13, 2019

Stated responseCorrected all modified direct deposit information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov