HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Brown Brothers Harriman & Co
bd_5356339cda8f7cbb · schema v1 · pii pii-v1
Full breach record for Brown Brothers Harriman & Co →Brown Brothers Harriman & Co (BBH) notified the New Hampshire Attorney General of a data security incident involving its third-party vendor, R.R. Donnelley. In March 2022, BBH learned that an unauthorized party had extracted BBH files from RRD's environment following a December 2021 intrusion at RRD. The breach affected approximately 66 New Hampshire residents, exposing names, addresses, Social Security numbers, and account numbers. BBH provided 36 months of credit monitoring and identity restoration services to affected individuals.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_65ac691fa66c3f10Montana State AGfiled 2022-05-11(5d gap)Candidate
- bd_debebf402777b267Maine State AGfiled 2022-05-11(5d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/brown-brothers-harriman-20220516.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 16, 2022
- Raw hash
- dd96cc08ed3339c8b272590f7ce8a232b9db6d404f976fabae5d59a2e353b310
Reporting entity
- Name
- Hunton Andrews Kurth LLPnorm: hunton andrews kurth
Victim entity
- Name
- Brown Brothers Harriman & Conorm: brown brothers harriman
Incident
- Discovered
- Mar 1, 2022
- Materiality determined
- —
- Notification sent
- May 23, 2022
- Affected individuals
- 66
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General
- Third party
- via R.R. Donnelley & Sons Company
- Initial access
- supply_chain
Compliance
- Time to disclose
- 11 weeks(76 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.