AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

HSBC FINANCE CORPORATION

bd_9ca61cba109a8185 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 27, 2015

Filed

Apr 10, 2015

To disclose

14 days

Affected

685state residents only

Linked

3 filings

Confidence

66%

Full breach record for HSBC FINANCE CORPORATION →2 incidents on file

HSBC Finance Corporation notified the NH Attorney General of a data breach affecting 685 NH residents. Personal info (names, SSNs, account numbers) was inadvertently made accessible via the Internet towards the end of 2014. Discovered March 27, 2015. Notices sent April 9, 2015. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 116 days

discovery → filing · 14 days

Dec 1, 2014

Begins

Mar 27, 2015

Discovered

Apr 10, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_3d7fd7b39104f29e2015-04-10Candidate
South Carolina State AGbd_d2938476ec4611582015-04-13 · +3dVerified

Name: HSBC FINANCE CORPORATION
norm: hsbc finance

Name: HSBC FINANCE CORPORATION
norm: hsbc finance
Industry: Financial Servicesllm

Discovered: Mar 27, 2015
Breach occurred: Dec 1, 2014
Undetected for: 116 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 9, 2015
Affected individuals: 685state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified law enforcementNotified credit reporting agencies

During the incident: Conducted a thorough review of the potentially affected records
Implemented additional security measures designed to prevent a recurrence
Ensured that the information is no longer accessible publicly
Notified law enforcement
Notified credit reporting agencies
Began notifying affected customers on April 9, 2015
Offered a free one-year subscription to Identity Guard
Changes made: Implemented additional security measures designed to prevent a recurrence of such an incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGApr 10 · first

New Hampshire State AGApr 10 · first · this page

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hsbc-finance-20150410.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2015
Raw hash: 2b0beff96775450a2c8c1440a1140fc6b85760c91d51f1d4739a07c23e06005b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHSBC FINANCE CORPORATION

Victim entityHSBC FINANCE CORPORATION

Incidentdiscovered Mar 27, 2015

Stated responseConducted a thorough review of the potentially affected records

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov