AccidentalHealthcareProfessional ServicesHealthcareMisconfigurationEmployee Data InvolvedGovernment IDIdentity (basic)EmploymentMediumContained

Independent Services Network

bd_74dbdaf938f1038c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 25, 2017

Filed

Jan 31, 2017

To disclose

6 days

Affected · nationwide

144134 in this filing

Confidence

66%

Full breach record for Independent Services Network →2 incidents on file

Independent Services Network, Inc. (ISN) notified the NH Attorney General of a data security incident affecting 144 employees (134 NH residents). On January 25, 2017, ISN mailed W-2 forms to employees. Due to a software upgrade in QuickBooks, Social Security Numbers were printed in a new location, making them visible through the transparent windows of the mailing envelopes. ISN discovered the issue shortly after mailing. The affected data included names, addresses, and SSNs. ISN notified affected employees, recommended credit freezes, offered reimbursement for freeze costs for two years, and implemented new distribution measures for W-2s.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 days

Jan 25, 2017

Begins

Jan 25, 2017

Discovered

Jan 31, 2017

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed144 affectedView incident

Name: Independent Services Network
norm: independent services network
Domain: isnnh.com

Name: Independent Services Network
norm: independent services network
Domain: isnnh.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jan 25, 2017
Breach occurred: Jan 25, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 28, 2017
Affected individuals: 144state + nationwide
Data types: Government IDIdentity (basic)Employment
Data elements: Social Security number
Attack vector: Unknown
Regulator citations: Notified Attorney General Joseph Foster

During the incident: Provided notice to affected employees
Designated certain individuals within the company to directly address any concerns
Requested that all potentially affected employees place a security freeze on their credit accounts
Provided employees with instructions and contact information to place a security freeze
Offered to reimburse employees for costs associated with the security freeze for the next two years
Changes made: Implemented new measures for distributing W-2s to safeguard against similar matters in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/independent-services-network-20170131.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2017
Raw hash: 341e697d2ce19a9a3727ce3626ae9350dbb1c5bd0daaed00228b8dc19d53d5f1

Reporting entityIndependent Services Network

Victim entityIndependent Services Network

Incidentdiscovered Jan 25, 2017

Stated responseProvided notice to affected employees

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov