MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedTargetedGovernment IDIdentity (basic)EmploymentHighContained

Purdue Pharma L.P.

bd_76ff944ccd99f639 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 1, 2008

Filed

May 9, 2008

To disclose

10 weeks

Affected · nationwide

5,00015 in this filing

Confidence

66%

Purdue Pharma L.P. notified the New Hampshire Attorney General of an incident involving a former employee who accessed a disk containing personal information of approximately 5,000 individuals, including 15 New Hampshire residents. The data included names, dates of birth, Social Security numbers, and pension information. The former employee attempted to email the data before leaving the company. Purdue recovered the disk, believes copies were deleted, and provided two years of identity theft protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 69 days

Mar 1, 2008

Discovered

May 9, 2008

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5,000 affectedView incident

Name: Purdue Pharma L.P.
norm: purdue pharma
Domain: purdueglobal.edu

Name: Purdue Pharma L.P.
norm: purdue pharma
Domain: purdueglobal.edu
Industry: Healthcarellm

Discovered: Mar 1, 2008
Materiality determined: —
Notification sent: Apr 14, 2008
Affected individuals: 5,000state + nationwide
Data types: Government IDIdentity (basic)Employment
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Demanded that the information be deleted and returned
Undertook a thorough investigation of this matter
Provided identity theft protection services for two years
Contracted with TrustedID to provide services
Contacted the three major U.S. credit bureaus to inform them of this incident
Changes made: Reviewing safeguards in place to protect the security of personal information
Examining measures to help prevent incidents of this kind from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/purdue-pharma-20080509.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2008
Raw hash: b89647dbbf8e4a3cfc224889ad87650409c68dbb0628cb84edb93c2bc00a9c35

Reporting entityPurdue Pharma L.P.

Victim entityPurdue Pharma L.P.

Incidentdiscovered Mar 1, 2008

Stated responseDemanded that the information be deleted and returned

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov