MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Newport

bd_9247d9734b1c370e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 2, 2023

Filed

Feb 16, 2024

To disclose

15 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Newport →

Newport Group, Inc. notified participants of a ransomware event affecting its third-party vendor, Infosys McCamish Systems (IMS), on November 2, 2023. The breach date is listed as October 29, 2023. IMS processes transactions for non-qualified deferred compensation plans. While IMS stated there is no evidence that participant information (name, address, date of birth, SSN) was impacted, Newport offered one year of complimentary identity protection through Experian as a precaution. Unit 42 and EY were engaged for security validation and e-discovery. The IMS environment was restored and hardened.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 15 weeks / 106 days

Oct 29, 2023

Begins

Nov 2, 2023

Discovered

Feb 16, 2024

Filed

vs. sector median

+5 wks slower

Part of INFOSYS MCCAMISH SYSTEMS, LLC supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Newport
norm: newport
Domain: newport.com

Name: Newport
norm: newport
Domain: newport.com
Industry: Financial Servicesllm

Discovered: Nov 2, 2023
Breach occurred: Oct 29, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Third party: via Infosys McCamish Systems
Initial access: supply_chain

During the incident: Disconnected and isolated the impacted IMS systems
Engaged a leading third-party security expert, Unit 42, part of Palo Alto Networks, to validate the scope of the incident and handle remediation
Engaged a leading e-discovery firm, EY, to determine whether data of any of the plans or participants that we service was impacted
Offering a complimentary one-year identity protection package through Experian, called IdentityWorks
Changes made: Successfully restored and rebuilt its environment
Hardened the IMS environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-581102
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 16, 2024
Raw hash: fb553a8066bda671d0482b032166af5a4c1d3f94907e88c01ecb514144530c2e

Reporting entityNewport

Victim entityNewport

Incidentdiscovered Nov 2, 2023

Stated responseDisconnected and isolated the impacted IMS systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov