AccidentalFinancial ServicesFinanceMisconfigurationDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

ING

bd_857b1f38e7834144 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 25, 2010

Filed

Feb 3, 2010

To disclose

9 days

Affected · nationwide

10617 in this filing

Confidence

67%

Full breach record for ING →10 incidents on file

ING Funds notified NH AG of a security breach affecting 106 shareholders (17 NH residents). An electronic file containing names, SSNs, and account numbers was mistakenly posted to ingfunds.com in August 2008 and remained accessible via search engine until detected on Jan 25, 2010. ING removed the file, changed account numbers, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 542 days

discovery → filing · 9 days

Aug 1, 2008

Begins

Jan 25, 2010

Discovered

Feb 3, 2010

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed106 affectedView incident

Name: ING
norm: ing
Domain: ing.com

Name: ING
norm: ing
Domain: ing.com
Industry: Financial Servicesllm

Discovered: Jan 25, 2010
Breach occurred: Aug 1, 2008
Undetected for: 542 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 106state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Notified New Hampshire Attorney General

During the incident: Removed the information from the website server
Reviewed all activity since June 2008 in all affected accounts
Changed the account number on their accounts
Offered each customer one year of free credit monitoring and identity fraud coverage
Changes made: Instituted additional safeguards to reduce the chance of and protect against improper disclosure of personal data
Strict guidelines exist to instruct our personnel on how personal information is to be gathered, stored and used
Technologies that guard the confidentiality of our customer databases
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ing-funds-20100203.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2010
Raw hash: ed19658f262694a07f267bd32485acae8714b4b7d52366f8b3dc59cf03a124c9

Reporting entityING

Victim entityING

Incidentdiscovered Jan 25, 2010

Stated responseRemoved the information from the website server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov