AccidentalFinancial ServicesTechnologyFinanceMisdeliveryDelayed DiscoveryGovernment IDIdentity (basic)MediumContained

Alight Solutions LLC

bd_971b290d0cebc829 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 20, 2019

Filed

Aug 21, 2019

To disclose

13 weeks

Affected

46state residents only

Linked

4 filings

Confidence

66%

Full breach record for Alight Solutions LLC →6 incidents on file

Alight Solutions LLC notified the NH AG of an inadvertent disclosure of PII (SSN, DOB) for 46 NH residents. Issues: 1) SSNs in email properties (Sept 2014-June 2019). 2) SSN/DOB in URLs to third parties (Oct 2016-Feb 2019). Discovered May 20, 2019. Remediated by encrypting emails and removing PII from URLs. Notifications sent Aug 26, 2019 with 2 years identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1701 days

discovery → filing · 13 weeks / 93 days

Sep 22, 2014

Begins

May 20, 2019

Discovered

Aug 21, 2019

Filed

vs. sector median

+5 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_018c338c00d4dff82019-08-20 · +1dCandidate
Massachusetts State AGbd_69bb2e24c95a52232019-08-20 · +1dVerified
California State AGbd_8bb43e9130dac3222019-08-20 · +1dVerified

Name: Alight Solutions LLC
norm: alight solutions
Domain: alight.com
Industry: Benefits Administration

Name: Alight Solutions LLC
norm: alight solutions
Domain: alight.com
Industry: Benefits Administration
Industry: Financial ServicesllmTechnologyllm

Discovered: May 20, 2019
Breach occurred: Sep 22, 2014 – Feb 22, 2019
Undetected for: 1,701 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2019
Affected individuals: 46state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Courtesy notification to New Hampshire Attorney General

During the incident: Initiated an investigation
Encrypted Social Security Numbers in the email properties of both forms of system-generated emails
Removed personal information from the URLs linking SmartBenefits to the trusted third-parties
Providing the affected Participants with a written notification
Offering two years of complimentary identity theft protection services through InfoArmor
Changes made: Encrypted Social Security Numbers in the email properties
Removed personal information from URLs linking to third-party websites
Continually evaluates and modifies practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGAug 20 · first

Massachusetts State AGAug 20 · first

California State AGAug 20 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/alight-solutions-20190821.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2019
Raw hash: 54396052a1fee6e5defa9ae2e8f6001f2c4920cec9889334c65a822134328f3f

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAlight Solutions LLC

Victim entityAlight Solutions LLC

Incidentdiscovered May 20, 2019

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov