HackingHealthcareTechnologyHealthcareStolen CredentialsData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)FinancialMediumContained

GlaxoSmithKline (GSK)

bd_a1ca24b9d09f6bec · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 14, 2016

Filed

Mar 25, 2016

To disclose

11 days

Affected · nationwide

5664 in this filing

Confidence

66%

Full breach record for GlaxoSmithKline (GSK) →

GlaxoSmithKline (GSK) notified employees of a data breach involving a third-party vendor storing W-2 and payroll data. Unauthorized access occurred Feb 7–Mar 13, 2016. Affected data included SSNs, names, addresses, income info, and DOBs for approx. 566 US employees. GSK engaged federal authorities, provided 12 months of identity protection via InfoArmor, and the vendor closed the access point.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 36 days

discovery → filing · 11 days

Feb 7, 2016

Begins

Mar 14, 2016

Discovered

Mar 25, 2016

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed566 affectedView incident

Name: GlaxoSmithKline (GSK)
norm: glaxosmithkline gsk

Name: GlaxoSmithKline (GSK)
norm: glaxosmithkline gsk
Industry: HealthcarellmTechnologyllm

Discovered: Mar 14, 2016
Breach occurred: Feb 7, 2016 – Mar 13, 2016
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 25, 2016
Affected individuals: 566state + nationwide
Data types: Government IDIdentity (basic)Financial
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Working closely with federal authorities
Initial access: supply_chain

During the incident: Implemented security measures designed to prevent a recurrence
Conducting a review of the potentially affected computer systems and records
Arranged to have InfoArmor protect the identity of affected current and former employees for 12 months at no cost
Working closely with federal authorities
Changes made: Vendor closed the access point used by the perpetrators
Dedicated team investigating processes and systems with third party vendors to reduce likelihood of future attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 days(11 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/GlaxoSmithKline-GSK.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2016
Raw hash: 8d3653041f6d2cd588c2e43daeffc7fc5823f87b5b3fe832dfcdf6ba354834f8

Reporting entityGlaxoSmithKline (GSK)

Victim entityGlaxoSmithKline (GSK)

Incidentdiscovered Mar 14, 2016

Stated responseImplemented security measures designed to prevent a recurrence

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov