PhysicalTechnologyInformationTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsHighContained

ARROW ELECTRONICS, INC.

bd_7467ceb6c06b6dd8 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 19, 2010

Filed

Mar 3, 2010

To disclose

12 days

Affected · nationwide

4,04452 in this filing

Confidence

66%

Full breach record for ARROW ELECTRONICS, INC. →3 incidents on file

Arrow Electronics, Inc. reported the theft of a laptop containing employee PII (names, SSNs, credit card numbers) from its NY office on Feb 18, 2010. Discovered Feb 19, 2010. 4,044 employees affected, including 52 NH residents. Notifications sent March 3, 2010, offering credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 12 days

Feb 18, 2010

Begins

Feb 19, 2010

Discovered

Mar 3, 2010

Filed

vs. sector median

17 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,044 affectedView incident

Name: ARROW ELECTRONICS, INC.
norm: arrow electronics
Domain: arrow.com

Name: ARROW ELECTRONICS, INC.
norm: arrow electronics
Domain: arrow.com
Industry: Technologyllm

Discovered: Feb 19, 2010
Breach occurred: Feb 18, 2010
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Mar 3, 2010
Affected individuals: 4,044state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Notified law enforcement
Investigated the situation
Engaged Kroll, Inc. (“Kroll”) to examine the copied back-up files to identify and extract all personal information
Engaged Edwards Angell Palmer & Dodge LLP to advise on legal obligations under applicable state and federal laws
Determined what information had been compromised
Committed to notify and offer solutions to the affected individuals
Prepared notices for distribution to individuals and governmental authorities explaining the incident and steps undertaken to protect affected individuals
Notified American Express of the potentially compromised corporate credit card numbers
Changes made: Increasing the profile of data security issues within the company at all levels, up to and including senior management
Reinforcing its processes in its annual Security Awareness Program for all of its employees globally
Provide additional training for individuals tasked with handling highly sensitive data
Accessing safeguards during the Company's internal audit
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/arrow-electronics-20100303.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2010
Raw hash: 3590b44dd6a19c5a142f3a31f3bf111f9d4c485dbbf2413fbb63192243291b7a

Reporting entityARROW ELECTRONICS, INC.

Victim entityARROW ELECTRONICS, INC.

Incidentdiscovered Feb 19, 2010

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov