MisuseFinancial ServicesTechnologyFinancePrivilege AbuseData MishandlingEmployee Data InvolvedCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountPIICriticalActive

Certegy

bd_7642ebc4c23e54ec · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 27, 2007

Filed

Jul 5, 2007

To disclose

8 days

Affected · nationwide

2,300,0006,933 in this filing

Confidence

65%

Full breach record for Certegy →2 incidents on file

Certegy Check Services, Inc. disclosed that a former senior database administrator misappropriated and sold consumer data (names, addresses, DOB, bank/credit card info) to a data broker for marketing purposes. The incident was discovered on June 27, 2007. Approximately 2.3 million records were affected nationwide, including 6,933 New Hampshire residents. No identity theft or fraud was detected. The employee was terminated, and law enforcement was engaged.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 days

Jun 27, 2007

Discovered

Jul 5, 2007

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,300,000 affectedView incident

Name: Certegy
norm: certegy
Domain: certegy.com

Name: Certegy
norm: certegy
Domain: certegy.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Jun 27, 2007
Materiality determined: —
Notification sent: Jul 5, 2007
Affected individuals: 2,300,000state + nationwide
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Date of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1052 Exfiltration Over Physical MediumT1119 Automated Collection
Threat actor: InternalFinancial
Regulator citations: Notified HHS
Initial access: insider_action

During the incident: Filed a civil complaint in St. Petersburg, Florida against the former employee and the marketing companies
Contacted the applicable marketing companies in order to obtain the return of all consumer information
Proactively engaged law enforcement and is encouraging immediate prosecution
Alerted the nation’s three major credit reporting agencies, TransUnion, Equifax and Experian
Notified Visa and MasterCard of the incident
Establishing a procedure for financial institutions to obtain information about their customers’ accounts so that they can place them on an active fraud watch
Personally notifying all affected consumers of this misappropriation, and establishing a toll-free hotline to answer consumer questions
Implemented a fraud watch on its internal systems for those checking accounts that are implicated
Changes made: Terminated the employee
Taking steps to help prevent future incidents
Continually reviews its security policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/certegy-20080705.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 5, 2007
Raw hash: 71ecbdfea54c8472ee3e1157d5dddc2ad20e2aa26206aa6fc6d4300d7d162db9

Reporting entityCertegy

Victim entityCertegy

Incidentdiscovered Jun 27, 2007

Stated responseFiled a civil complaint in St. Petersburg, Florida against the former employee and the marketing companies

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov