HackingProfessional ServicesProfessional ServicesStolen CredentialsEmployee Data InvolvedIdentity (basic)EmploymentLowContained

NRI

bd_81c5e8d75d758258 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 15, 2019

Filed

Aug 14, 2020

To disclose

43 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for NRI →

NRI USA, LLC experienced unauthorized access to two corporate email accounts between September 3 and October 23, 2019. The incident was discovered on October 15, 2019, when an unauthorized individual attempted to misdirect a payment. The attacker used valid credentials to access the accounts, potentially exposing personal information of employees, including names and employment details. NRI disabled the accounts, reset passwords, and engaged Kroll for identity monitoring. Remediation steps include implementing two-factor authentication and enhancing email security filters.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 42 days

discovery → filing · 43 weeks / 304 days

Sep 3, 2019

Begins

Oct 15, 2019

Discovered

Aug 14, 2020

Filed

vs. sector median

+25 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: NRI
norm: nri
Domain: nri3pl.com

Name: NRI
norm: nri
Domain: nri3pl.com
Industry: Professional Servicesllm

Discovered: Oct 15, 2019
Breach occurred: Sep 3, 2019 – Oct 23, 2019
Undetected for: 42 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Employment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Providing notice of this incident to appropriate regulators
Initial access: valid_credentials

During the incident: Disabled the affected email accounts
Had the users reset their passwords
Secured the services of Kroll to provide identity monitoring
Changes made: Adding two-factor authentication for remote access to Office 365 services, including email
Regular review of all remote logins to corporate email accounts
Network-wide review of all forwarding rules
Strengthening our filtering to help block dangerous emails
Updating our response procedures to more quickly and effectively respond to incidents
Adding a warning about phishing attempts and attempts to re-route payments to all emails
Enhancing our cyber training and providing regular communications in order to increase cyber awareness
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 43 weeks(304 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193073
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2020
Raw hash: 5ed2f4a740d336c438f40a5f23fbd240611c618690ddc9007580dc214d7cb883

Reporting entityNRI

Victim entityNRI

Incidentdiscovered Oct 15, 2019

Stated responseDisabled the affected email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov