MisuseTechnologyFinancial ServicesInformationPrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowActive

Toshiba America Information Systems, Inc.

bd_64ef6b92c1fcd92e · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 8, 2013

Filed

Apr 30, 2013

To disclose

22 days

Affected

4state residents only

Confidence

66%

Full breach record for Toshiba America Information Systems, Inc. →2 incidents on file

Revana, Inc., a customer service provider for Toshiba America Information Systems, Inc., notified the NH AG of a data security incident. On April 8, 2013, Revana discovered that employees had improperly saved personal information (names, addresses, credit card numbers, CVVs) of 4 NH residents on non-secure computers from August 2012. Revana terminated access, suspended/resigned employees, and is strengthening safeguards. Notifications sent May 1, 2013.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 250 days

discovery → filing · 22 days

Aug 1, 2012

Begins

Apr 8, 2013

Discovered

Apr 30, 2013

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4 affectedView incident

Name: Revana Estate
norm: revana estate
Domain: revanawine.com

Name: Toshiba America Information Systems, Inc.
norm: toshiba america information
Industry: TechnologyllmFinancial Servicesllm

Discovered: Apr 8, 2013
Breach occurred: Aug 1, 2012
Undetected for: 250 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 1, 2013
Affected individuals: 4state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Regulator citations: Notified New Hampshire Attorney General
Initial access: insider_action

During the incident: Launched an intensive internal investigation
Conducted forensic examination of computers
One representative resigned and the other was suspended pending termination
Access to the system has been terminated for the involved representatives
Revana computers have been and are being examined forensically
Re-evaluating and strengthening administrative and physical safeguards
Re-stressing customer privacy in the training of its employees
Setting up a toll free number for affected consumers
Changes made: Re-evaluating and strengthening administrative and physical safeguards
Re-stressing customer privacy in the training of its employees
Working with Toshiba to enhance security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/toshiba-america-20130430.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 30, 2013
Raw hash: 4403afb64bd3e8ec41b7e01c5f8ba5002833e6f99ba8cd12d29861eb58f2e326

Reporting entityRevana Estate

Victim entityToshiba America Information Systems, Inc.

Incidentdiscovered Apr 8, 2013

Stated responseLaunched an intensive internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov