HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

PENNSYLVANIA REAL ESTATE INVESTMENT TRUST

bd_98ce7dd4d5bad1de · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 16, 2014

Filed

Jun 11, 2014

To disclose

8 weeks

Affected

2state residents only

Confidence

66%

Full breach record for PENNSYLVANIA REAL ESTATE INVESTMENT TRUST →2 incidents on file

Pennsylvania Real Estate Investment Trust (PREIT) filed a supplemental notice to the New Hampshire Attorney General regarding unauthorized access to its third-party hosted HR system (UltiPro) on February 23, 2014. PREIT discovered the incident on April 16, 2014. The breach exposed names, addresses, SSNs, and DOBs of employees and dependents. This filing specifically notifies 2 New Hampshire residents of additional affected individuals identified later.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 52 days

discovery → filing · 8 weeks / 56 days

Feb 23, 2014

Begins

Apr 16, 2014

Discovered

Jun 11, 2014

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: PENNSYLVANIA REAL ESTATE INVESTMENT TRUST
norm: pennsylvania real estate investment

Name: PENNSYLVANIA REAL ESTATE INVESTMENT TRUST
norm: pennsylvania real estate investment
Industry: Financial Servicesllm

Discovered: Apr 16, 2014
Breach occurred: Feb 23, 2014
Undetected for: 52 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 11, 2014
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of Ultimate Software
Contacted law enforcement
Offering one year of complimentary credit monitoring and identity theft protection services through Experian
Changes made: Enhanced safeguards have been implemented in the UltiPro system including the implementation of multi-factor authentication for access to sensitive information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pennsylvania-real-estate-20140611.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2014
Raw hash: ace766b345073b1a688e83d2a2147acdd69cdec4e1a132525c3ec44a18da094c

Reporting entityPENNSYLVANIA REAL ESTATE INVESTMENT TRUST

Victim entityPENNSYLVANIA REAL ESTATE INVESTMENT TRUST

Incidentdiscovered Apr 16, 2014

Stated responseLaunched an investigation with the assistance of Ultimate Software

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov