Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

TDC Virginia Benefits & Risk Management, Inc.

bd_632dda95206757fd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 9, 2019

Filed

Dec 6, 2019

To disclose

17 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for TDC Virginia Benefits & Risk Management, Inc. →2 incidents on file

TDC Virginia Benefits & Risk Management, Inc. notified Montana residents of an unauthorized access to an employee email account discovered on August 9, 2019. The incident involved phishing leading to credential compromise. Data impacted included client-provided policy participant information. Kroll provided one year of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 119 days

Aug 9, 2019

Discovered

Dec 6, 2019

Filed

vs. sector median

1 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_07d50a66a312fec52019-12-06Verified

Name: TDC Virginia Benefits & Risk Management, Inc.
norm: tdc virginia benefits risk management

Name: TDC Virginia Benefits & Risk Management, Inc.
norm: tdc virginia benefits risk management
Industry: Professional Servicesllm

Discovered: Aug 9, 2019
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Secured the employee’s email account
Launched an investigation to determine the nature and scope of the incident
Engaged a computer security firm to assist
Conducted a comprehensive review of the emails and attachments in the account
Engaged the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Implementing additional procedures to further expand and strengthen our security processes
Providing continued education and training to our employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGDec 6 · first

Montana State AGDec 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-32.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 6, 2019
Raw hash: c0d49fc78c1a088625cd0af75758e681c410a633e60069cc9e93d6e03aa9e54f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTDC Virginia Benefits & Risk Management, Inc.

Victim entityTDC Virginia Benefits & Risk Management, Inc.

Incidentdiscovered Aug 9, 2019

Stated responseSecured the employee’s email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov