MalwareProfessional ServicesTechnologyProfessional ServicesRansomwareData ExfiltratedRansom DemandedIdentity (basic)Government IDEmploymentMediumContained

Collabera

bd_889cc32e696bff5c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 8, 2020

Filed

Jul 9, 2020

To disclose

4 weeks

Affected

Not disclosed

Linked

9 records

Confidence

68%

Full breach record for Collabera →

Collabera, Inc. reported a ransomware attack in Washington state. Unauthorized access occurred between May 24 and June 8, 2020. The attacker exfiltrated employee PII including SSNs and DOBs. Collabera restored data from backups, engaged forensic experts, and offered 2 years of credit monitoring. Notifications were mailed to Washington residents in July 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 4 weeks / 31 days

May 24, 2020

Begins

Jun 8, 2020

Discovered

Jul 9, 2020

Filed

vs. sector median

15 wks faster

This filing is one of 9 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemazebd_5d5bd239a535e0f92020-06-08 · +31dVerified by operator

Regulatory filings (7) · sorted by filing gap

Montana State AGbd_e6483d8e749b4d982020-07-09Verified
Indiana State AGbd_041bbb0ab945452d2020-07-10 · +1dVerified by operator
Delaware State AGbd_8d1bb831591496b22020-07-10 · +1dVerified by operator
New Hampshire State AGbd_83c901139b1156f82020-07-17 · +8dVerified by operator

Show 3 more filings ↓up to 12d gap

Oregon State AGbd_534cb167d91a2bab2020-07-21 · +12dVerified
Massachusetts State AGbd_a1782f53e1d2060f2020-07-21 · +12dVerified
California State AGbd_b7536fb665576b4c2020-07-21 · +12dVerified

Name: Collabera
norm: collabera
Domain: collabera.com

Name: Collabera
norm: collabera
Domain: collabera.com
Industry: Professional ServicesllmTechnologyllm

Discovered: Jun 8, 2020
Breach occurred: May 24, 2020 – Jun 8, 2020
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: NameSocial Security numberDate of birthPassport number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General

During the incident: Restored access to data from backup files
Removed malware from the system
Launched an investigation to determine the nature and scope of this event
Working with outside forensic experts and law enforcement
Providing individual notifications
Offering credit monitoring and identity theft protection for two years
Retained a network security and forensic firm to investigate the incident
Changes made: Enhanced data security measures (data minimization, destruction and/or encryption)
Implementing new technical safeguards (additional firewalls, additional endpoint detection & response agents, additional multifactor authentication, additional logging and monitoring)
Changed passwords
Revised procedures
Implementing enhanced training procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Montana State AGJul 9 · first

Washington State AGJul 9 · first · this page

Indiana State AG+1d

Delaware State AG+1d

New Hampshire State AG+8d

Oregon State AG+12d

Massachusetts State AG+12d

California State AG+12d

Pattern: first filing Jul 9 (MT), last Jul 21 (CA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10568.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2020
Raw hash: 74502ef404c9bf5938abd19985b149e1b381971a39435a10cfe622b7d606036c

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityCollabera

Victim entityCollabera

Incidentdiscovered Jun 8, 2020

Stated responseRestored access to data from backup files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com