MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

HSBC BANK USA, NATIONAL ASSOCIATION

bd_53f90c660b1f44ef · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 20, 2012

Filed

Jan 31, 2013

To disclose

6 weeks

Affected

11state residents only

Linked

2 filings

Confidence

66%

Full breach record for HSBC BANK USA, NATIONAL ASSOCIATION →13 incidents on file

HSBC Bank USA, N.A. notified the New Hampshire Attorney General of a breach involving 11 NH residents. An employee accessed customer data between August and December 2012 to supply fraudsters with PII for fraudulent withdrawals. HSBC terminated the employee, reported to NY Special Frauds Unit, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 129 days

discovery → filing · 6 weeks / 42 days

Aug 13, 2012

Begins

Dec 20, 2012

Discovered

Jan 31, 2013

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_6187a260934cedbc2013-02-01 · +1dVerified

Name: HSBC BANK USA, NATIONAL ASSOCIATION
norm: hsbc bank usa national

Name: HSBC BANK USA, NATIONAL ASSOCIATION
norm: hsbc bank usa national
Industry: Financial Servicesllm

Discovered: Dec 20, 2012
Breach occurred: Aug 13, 2012 – Dec 18, 2012
Undetected for: 129 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 31, 2013
Affected individuals: 11state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: InternalFinancial
Regulator citations: Reported this incident to the New York Special Frauds Unit for further investigation
Initial access: insider_action

During the incident: Employee has been terminated
Reported this incident to the New York Special Frauds Unit for further investigation
Contacted some customers by telephone
Sent letters to all affected customers
Offered a free one-year subscription to ITAC Sentinel credit monitoring and identity theft protection service
Changes made: Offered a free one-year subscription to ITAC Sentinel credit monitoring and identity theft protection service
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJan 31 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hsbc-bank-20130131.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2013
Raw hash: 3a141244e0bf3d18352277cd4783de824353c7ba92916adab67cf3a56ea95c09

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHSBC BANK USA, NATIONAL ASSOCIATION

Victim entityHSBC BANK USA, NATIONAL ASSOCIATION

Incidentdiscovered Dec 20, 2012

Stated responseEmployee has been terminated

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov