MisuseProfessional ServicesProfessional ServicesPrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

Mercer HR Services, LLC

bd_945fedf460ccd750 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 28, 2014

Filed

May 6, 2014

To disclose

8 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Mercer HR Services, LLC →2 incidents on file

Mercer HR Services, LLC notified the NH Attorney General on May 6, 2014, of an insider incident discovered on April 28, 2014, involving the improper access of personal data (SSN, banking info) of at least one NH resident by a Mercer employee. Mercer is working with law enforcement and offering 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 days

Apr 28, 2014

Discovered

May 6, 2014

Filed

vs. sector median

18 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9f987b13b595814c2014-05-07 · +1dVerified

Name: Mercer HR Services, LLC
norm: mercer hr

Name: Mercer HR Services, LLC
norm: mercer hr
Industry: Professional Servicesllm

Discovered: Apr 28, 2014
Materiality determined: —
Notification sent: May 6, 2014
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified Office of the Attorney General (Consumer Protection and Antitrust Bureau)
Initial access: insider_action

During the incident: Took steps to investigate the matter
Placed security holds on the accounts to require authentication for any changes or transfers
Working with law enforcement on this matter
Notified the three national credit bureaus — Experian, Equifax, and TransUnion
Notified the relevant 401(k) plan sponsors
Providing complimentary credit protection services for two years
Changes made: Placed restrictions on access and distribution requests for your account if made through its online tool
Monitoring all calls regarding your account to ensure they are legitimate
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMay 6 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mercer-hr-services-20140506.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 6, 2014
Raw hash: 724616f2e55166101e3e4e8770c5d225a772dd7cf8a61e9673a0152e75a5248c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMercer HR Services, LLC

Victim entityMercer HR Services, LLC

Incidentdiscovered Apr 28, 2014

Stated responseTook steps to investigate the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov