AccidentalManufacturingProfessional ServicesManufacturingMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDPHIMediumResolved

WillScot Mobile Mini Holdings Corp.

bd_5bcbecc37db6bbb8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 10, 2020

Filed

Nov 20, 2020

To disclose

10 days

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for WillScot Mobile Mini Holdings Corp. →

WillScot Mobile Mini Holdings Corp. notified Montana residents of a data breach on November 10, 2020, where an HR employee inadvertently emailed a spreadsheet containing sensitive employee PII (name, address, DOB, SSN, health insurance Member ID) to Mobile Mini managers. WillScot deleted the emails immediately, found no evidence of unauthorized access, and offered 2 years of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 days

Nov 10, 2020

Begins

Nov 10, 2020

Discovered

Nov 20, 2020

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_3e99aa0aaf128eb02020-11-20Verified
Massachusetts State AGbd_415ac35d076f517b2020-11-19 · +1dVerified
Indiana State AGbd_ab8bda1225cf62f32020-11-19 · +1dVerified
Maine State AGbd_6beff7b12a9bd2b62020-11-11 · +9dCandidate

Name: WillScot Mobile Mini Holdings Corp.
norm: willscot mobile mini

Name: WillScot Mobile Mini Holdings Corp.
norm: willscot mobile mini
Industry: ManufacturingllmProfessional Servicesllm

Discovered: Nov 10, 2020
Breach occurred: Nov 10, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDPHI
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1534 Internal Remote Services
Threat actor: Internal

During the incident: Deleted all copies of the email and related attachments from recipients’ inboxes and computers within minutes of the message being delivered
Retraining workforce on email security best practices
Investigating other software solutions to potentially help avoid an event like this from happening in the future
Arranged for affected individuals to enroll, at no cost, in credit monitoring and identity protection services for two (2) years through Experian
Changes made: Retraining workforce on email security best practices
Investigating other software solutions to potentially help avoid an event like this from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGNov 11 · first

Massachusetts State AG+8d

Indiana State AG+8d

New Hampshire State AG+9d

Montana State AG+9d · this page

Pattern: first filing Nov 11 (ME), last Nov 20 (MT) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/wilscotSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 20, 2020
Raw hash: 9eb3584308cb84352975a89f7a427c98da9ff70cf1b3ecf9282f88287dd0beb9

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWillScot Mobile Mini Holdings Corp.

Victim entityWillScot Mobile Mini Holdings Corp.

Incidentdiscovered Nov 10, 2020

Stated responseDeleted all copies of the email and related attachments from recipients’ inboxes and computers within minutes of the message being delivered

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov