AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

Fidelity Investments

bd_813e6bd137738b78 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 8, 2017

Filed

Jan 11, 2018

To disclose

5 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Fidelity Investments →98 incidents on file

Fidelity Investments notified NH AG of an inadvertent disclosure of one NH resident's PII (name, SSN, DOB, account info) to a third-party analytics vendor due to a configuration error. Occurred Nov 24-Dec 7, 2017. Discovered Dec 8, 2017. Data deleted by vendor; resident notified Jan 11, 2018 with credit monitoring offer.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 5 weeks / 34 days

Nov 24, 2017

Begins

Dec 8, 2017

Discovered

Jan 11, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_aafaaa8e716425292018-01-11Verified

Name: Fidelity Investments
norm: fidelity investments
Domain: fidelity.com

Name: Fidelity Investments
norm: fidelity investments
Domain: fidelity.com
Industry: Financial Servicesllm

Discovered: Dec 8, 2017
Breach occurred: Nov 24, 2017 – Dec 7, 2017
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 11, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Corrected the error that same day
Stopped sending account information to the third-party
Third-party firm deleted the data from its system
Notified the resident by letter
Changes made: Arranged for one year of complimentary credit monitoring through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 11 · first

New Hampshire State AGJan 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fidelity-investments-20180111.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2018
Raw hash: 7a370449469ef08f6e4ce7199a0a41ba4933e0a9c6e2a084a5b793122eab77cd

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFidelity Investments

Victim entityFidelity Investments

Incidentdiscovered Dec 8, 2017

Stated responseCorrected the error that same day

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov