HackingSupply Chain (3P Vendor)Customer Data InvolvedPIIIDENTITY_BASICLowContained
ERNST & YOUNG LLP
bd_9f0a166a0e807419 · schema v1 · pii pii-v1
Full breach record for ERNST & YOUNG LLP →Ernst & Young LLP (EY US) notified the NH Attorney General of a security incident involving third-party supplier Progress Software's MOVEit Transfer solution. EY US was informed of the vulnerability on May 31, 2023. The incident compromised files containing personal data of 72 New Hampshire residents. EY US engaged third-party security experts, secured systems, and began mailing notifications on August 9, 2023, offering credit monitoring services.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_342a8e17707d445dCalifornia State AGfiled 2023-08-09Candidate
- bd_51121ff37fe0619aDelaware State AGfiled 2023-08-09Verified
- bd_8403dcd75972f36eMaine State AGfiled 2023-08-09Verified
- bd_f2b7e0ce70ee52a5Washington State AGfiled 2023-08-09Verified
Show 1 more filing ↓Show fewer ↑up to 13d gap
- bd_43034954cfbe06ccOregon State AGfiled 2023-08-22(13d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/ernst-young-20230809.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 9, 2023
- Raw hash
- ebd148e2b150f3b4a4c451e3adbe0431052b0e525e90b8f635c7b5cf7b734cce
Reporting entity
- Name
- ERNST & YOUNG LLPnorm: ernst young
Victim entity
- Name
- ERNST & YOUNG LLPnorm: ernst young
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Aug 9, 2023
- Affected individuals
- 72
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General Consumer Protection Bureau
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(70 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.