Social EngineeringRetail & ConsumerHealthcareRetailExtortion DemandPhishingRansom DemandedData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)PHIMediumActive

TOYOTA MOTOR SALES, U.S.A., INC.

bd_85417b84d101de5e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 6, 2008

Filed

Nov 21, 2008

To disclose

15 days

Affected · nationwide

18823 in this filing

Confidence

67%

Full breach record for TOYOTA MOTOR SALES, U.S.A., INC. →

Toyota Motor Sales, U.S.A., Inc. notified the New Hampshire Attorney General of a security breach involving its pharmacy benefits manager, Express Scripts. An extortionist threatened to disclose personal information (names, SSNs, DOBs) of 188 Toyota associates. 23 New Hampshire residents were specifically identified. Toyota notified the FBI, sent notices to affected employees, and engaged Kroll for fraud prevention.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 days

Nov 6, 2008

Discovered

Nov 21, 2008

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed188 affectedView incident

Name: TOYOTA MOTOR SALES, U.S.A., INC.
norm: toyota motor sales usa

Name: TOYOTA MOTOR SALES, U.S.A., INC.
norm: toyota motor sales usa
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Nov 6, 2008
Materiality determined: —
Notification sent: Nov 20, 2008
Affected individuals: 188state + nationwide
Data types: Government IDIdentity (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1486 Data Encrypted for ImpactT1566 Phishing
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Office (Consumer Protection Bureau)
Third party: via Express Scripts
Initial access: supply_chain

During the incident: Sent informal e-mail notice to affected employees on November 14, 2008
Mailed formal notice of security breach on November 20 and 21, 2008
Notified the FBI agents involved with the Express Scripts investigation
Notified the 188 associates of the breach
Engaged Kroll, Inc. to provide fraud prevention assistance
Changes made: Offered fraud prevention assistance through Kroll, Inc.
Provided information on placing fraud alerts with credit bureaus
Provided information on placing security freezes with credit bureaus
Advised reviewing credit reports and account statements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/toyota-motor-sales-20081121.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2008
Raw hash: ac0556320f126cbdb5dcc31d49b3eb77a12d4a5c0e228271550e7f03cce0dca0

Reporting entityTOYOTA MOTOR SALES, U.S.A., INC.

Victim entityTOYOTA MOTOR SALES, U.S.A., INC.

Incidentdiscovered Nov 6, 2008

Stated responseSent informal e-mail notice to affected employees on November 14, 2008

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov