Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDEmploymentFinancial accountHighContained

TERMINIX GLOBAL HOLDINGS, INC.

bd_63678ffc75ec207d · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 16, 2020

Filed

Oct 9, 2020

To disclose

23 days

Affected

14,708

Linked

4 filings

Confidence

66%

Full breach record for TERMINIX GLOBAL HOLDINGS, INC. →3 incidents on file

Terminix Global Holdings disclosed that a teammate responded to a phishing scam, allowing hackers to access an Office 365 account and auto-forward emails from September 10 to September 22, 2020. The breach affected 14,708 current and former employees nationwide, exposing names, SSNs, dates of birth, employment dates, and 401K balances. The company contained the breach, disabled forwarding, and offered two years of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 23 days

Sep 10, 2020

Begins

Sep 16, 2020

Discovered

Oct 9, 2020

Filed

vs. sector median

14 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_da7fd964efebe1142020-10-09Verified
Maine State AGbd_3aab291eabee79222020-10-11 · +2dCandidate
New Hampshire State AGbd_07b98707c56023de2020-10-19 · +10dVerified

Name: TERMINIX GLOBAL HOLDINGS, INC.
norm: terminix global
Domain: servicemasterclr.com

Name: TERMINIX GLOBAL HOLDINGS, INC.
norm: terminix global
Domain: servicemasterclr.com
Industry: Professional Servicesllm

Discovered: Sep 16, 2020
Breach occurred: Sep 10, 2020 – Sep 22, 2020
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 14,708nationwide
Data types: Identity (basic)Government IDEmploymentFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notifying state authoritiesWorking with law enforcement agencies
Initial access: phishing_link

During the incident: Disabled the forwarding of the emails and contained the breach
Modified email filtering and account authorization protocol
Communicating to teammates to be diligent regarding potential scams
Requiring teammates to complete annual security awareness training
Issued specialized training to high-risk groups to recognize sophisticated phishing attempts
Working with law enforcement agencies to investigate this cybercrime
Notifying state authorities
Notified the provider of our 401K plans and the major credit agencies
Continuing to monitor the security of our systems
Changes made: Modified email filtering and account authorization protocol
Requiring teammates to complete annual security awareness training
Issued specialized training to high-risk groups to recognize sophisticated phishing attempts
Reinforce messages related to the importance of abiding by proper security and data handling measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 9 · first

California State AGOct 9 · first · this page

Maine State AG+2d

New Hampshire State AG+10d

Pattern: first filing Oct 9 (IN), last Oct 19 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194953
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2020
Raw hash: 3156e3f018cdc6dbeefd9cfe5b8face5980d101023ee0ade955a6a993b4e4343

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTERMINIX GLOBAL HOLDINGS, INC.

Victim entityTERMINIX GLOBAL HOLDINGS, INC.

Incidentdiscovered Sep 16, 2020

Stated responseDisabled the forwarding of the emails and contained the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov