Social EngineeringHealthcareHealthcarePhishingEmployee Data InvolvedTargetedIdentity (basic)Government IDEmploymentMediumContained

inVentiv Health, Inc.

bd_9e66be2ecd1822a8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 7, 2016

Filed

Jul 21, 2016

To disclose

14 days

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for inVentiv Health, Inc. →

inVentiv Health, Inc. experienced a targeted phishing attack in June 2016 where an employee uploaded U.S. employees' 2015 W-2 forms to a file-sharing site in response to a fraudulent email. The data exposed included names, addresses, Social Security numbers, and salary information. The company notified the IRS and FBI, enhanced security measures, and provided two years of credit monitoring to affected employees.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 7, 2016 → Notified Jul 19, 201612d ✓ CA 60-day OK14 days discovery → filing

Incident timeline

undetected · 36 days

discovery → filing · 14 days

Jun 1, 2016

Begins

Jul 7, 2016

Discovered

Jul 21, 2016

Filed

vs. sector median

10 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_52abf569691848e32016-07-21Candidate
New Hampshire State AGbd_c6c51c86f0cfba5b2016-07-21Verified

Name: inVentiv Health, Inc.
norm: inventiv health

Name: inVentiv Health, Inc.
norm: inventiv health
Industry: Healthcarellm

Discovered: Jul 7, 2016
Breach occurred: Jun 1, 2016 – Jun 30, 2016
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 19, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Notified the IRS and FBI
Initial access: phishing_link

During the incident: Notified the IRS and FBI of this incident and is cooperating with their investigations
Re-educating employees with respect to phishing emails
Taken steps to enhance existing security
Partnered with Equifax to provide Credit Watch Gold with 3-in-1 Monitoring identity theft protection product for two years at no charge
Changes made: Re-educating employees with respect to phishing emails
Taken steps to enhance existing security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: CA 60-day OK · 12d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 7, 2016
→ Notified: Jul 19, 2016
12d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 7, 2016 → Notified: Jul 19, 2016	12d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJul 21 · first

New Hampshire State AGJul 21 · first

California State AGJul 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-62962
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2016
Raw hash: 21d85cb4b3f4a14cfb2d462d16c4b4fa91e2668a991ec12984dd52becd91b94e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityinVentiv Health, Inc.

Victim entityinVentiv Health, Inc.

Incidentdiscovered Jul 7, 2016

Stated responseNotified the IRS and FBI of this incident and is cooperating with their investigations

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov