HackingHealthcareTechnologyHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

BIO-RAD LABORATORIES, INC.

bd_862796e4150c0717 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 2, 2018

Filed

Apr 4, 2018

To disclose

5 weeks

Affected

3state residents only

Confidence

66%

Full breach record for BIO-RAD LABORATORIES, INC. →

Bio-Rad Laboratories, Inc. notified the NH Attorney General of a breach involving its third-party service provider, Dunn & Bradstreet. Compromised credentials allowed unauthorized access to employee email accounts in June 2017, potentially exposing partner PII (name, address, phone, SSN/TIN). 3 NH residents affected. Bio-Rad engaged forensic investigators, notified law enforcement, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 274 days

discovery → filing · 5 weeks / 33 days

Jun 1, 2017

Begins

Mar 2, 2018

Discovered

Apr 4, 2018

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: BIO-RAD LABORATORIES, INC.
norm: bio rad laboratories

Name: BIO-RAD LABORATORIES, INC.
norm: bio rad laboratories
Industry: HealthcarellmTechnologyllm

Discovered: Mar 2, 2018
Breach occurred: Jun 1, 2017 – Jun 30, 2017
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Federal law enforcement was notified
Third party: via Dunn & Bradstreet
Initial access: valid_credentials

During the incident: Promptly initiated an investigation to determine the scope of the incident
Confirm the restoration of the security and integrity of the system
Offering one year of credit monitoring services to all of our potentially affected partners
Steps were taken to enhance its account security and other security protocols
A leading cybersecurity forensics firm was engaged
Federal law enforcement was notified
Changes made: Enhance account security and other security protocols
Offering one year of identity monitoring services at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bio-rad-20180404.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 4, 2018
Raw hash: 4959e88caa1e6fb473e71ba56abbe8b5a6fbefb836c1ecf3626e962b8df3502b

Reporting entityBIO-RAD LABORATORIES, INC.

Victim entityBIO-RAD LABORATORIES, INC.

Incidentdiscovered Mar 2, 2018

Stated responsePromptly initiated an investigation to determine the scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov