HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Financial accountLowActive

Symantec Corporation

bd_7b6f254948c9636a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 24, 2009

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Symantec Corporation →5 incidents on file

Symantec Corporation notified the New Hampshire Attorney General of a potential security incident involving a call center vendor. A UK media outlet alleged that credit card numbers of three UK residents were purchased from the call center. Symantec sent notification to one New Hampshire resident out of an abundance of caution, provided one year of identity protection services, and is investigating with law enforcement. No evidence of US resident compromise was found.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Mar 24, 2009

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_19fdc0a11b794b9f2009-03-27 · +3dVerified

Name: Symantec Corporation
norm: symantec

Name: Symantec Corporation
norm: symantec
Industry: Technologyllm

Discovered: —
Materiality determined: —
Notification sent: Mar 25, 2009
Affected individuals: 1state-resident count only
Data types: Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Kelly A. Ayotte
Initial access: valid_credentials

During the incident: Launched an investigation into the matter
Working with our call center vendor and law enforcement authorities
Sending written notification to one (1) resident of New Hampshire
Providing one year of identity protection services through Debix, Inc.
Informing the customers at issue that they should report suspected incidents of identity theft to the U.S. Federal Trade Commission and local law enforcement
Explaining to them how to place a fraud alert and/or security freeze on their credit file
Providing the contact information for the national credit reporting agencies
Changes made: Reviewing our security processes and third party vendor protocols and evaluating additional safeguards
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMar 24 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/symantec-20090324.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2009
Raw hash: 2cd760903377e3c9ae29a0bac71e83ca57832abf0054368dd15a20d8445ad7f7

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySymantec Corporation

Victim entitySymantec Corporation

IncidentUnauthorized Access

Stated responseLaunched an investigation into the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov