AccidentalOtherMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

Massachusetts Society for the Prevention of Cruelty to Children

bd_841f52e2b9f7d0b3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 24, 2014

Filed

Feb 12, 2014

To disclose

19 days

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for Massachusetts Society for the Prevention of Cruelty to Children →

MSPCC mistakenly mailed Form 1099s containing names, addresses, and SSNs to the wrong vendors on Jan 24, 2014. 2 NH residents affected. Notices mailed Feb 13, 2014. Remediation includes staff training and 12 months of credit monitoring via AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 days

Jan 24, 2014

Begins

Jan 24, 2014

Discovered

Feb 12, 2014

Filed

vs. sector median

3 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_f5e788225497467f2014-02-13 · +1dVerified

Name: Massachusetts Society for the Prevention of Cruelty to Children
norm: massachusetts society for the prevention of cruelty to children
Domain: mispcc.org

Name: Massachusetts Society for the Prevention of Cruelty to Children
norm: massachusetts society for the prevention of cruelty to children
Domain: mispcc.org
Industry: Otherllm

Discovered: Jan 24, 2014
Breach occurred: Jan 24, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 13, 2014
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Attorney General Joseph Foster pursuant to N.H. Rev. Stat. § 359-C:20

During the incident: Launched an investigation to determine the cause and impact of the incident
Requested that any vendor who called to notify MSPCC about the additional Form 1099 return that Form 1099 to MSPCC
Prepared written notices for those New Hampshire residents that it believes may have been affected
Partnered with AllClear ID to help protect from identity theft those individuals that may potentially have been affected
Made available for affected residents, free of charge, twelve (12) months of credit monitoring and identity theft insurance
Purchased twelve (12) months of recovery services for each resident
Provided affected residents with a toll-free number that they may call with questions about the incident
Resent Form 1099s to the correct vendors in order to comply with mailing deadlines
Changes made: Conducting supplemental training on staff responsibility and obligations to protect the confidentiality of personal information to better ensure that this type of incident does not occur again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGFeb 12 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/massachusetts-cruelty-children-20140212.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 12, 2014
Raw hash: 6f1f4d7412dbddc6a92b7838c4c318c978a0edf279d2bbe24bb4dcd96a0ead90

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMassachusetts Society for the Prevention of Cruelty to Children

Victim entityMassachusetts Society for the Prevention of Cruelty to Children

Incidentdiscovered Jan 24, 2014

Stated responseLaunched an investigation to determine the cause and impact of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov