PhysicalProfessional ServicesProfessional ServicesTheftEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

ACOSTA, INC.

bd_a78e8ca66d720a4a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 11, 2014

Filed

Dec 12, 2014

To disclose

4 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for ACOSTA, INC. →

Acosta, Inc. and subsidiaries reported the theft of a password-protected laptop belonging to an HR associate on November 10, 2014. The device was discovered missing on November 11, 2014. The laptop contained personal information of current and former employees and their dependents, including names, addresses, dates of birth, bank account information, Social Security numbers, employee ID numbers, phone numbers, and email addresses. The company confirmed the laptop was password-protected at the time of theft but is offering one year of credit monitoring and identity restoration services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 4 weeks / 31 days

Nov 10, 2014

Begins

Nov 11, 2014

Discovered

Dec 12, 2014

Filed

vs. sector median

14 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_04598a5ffbc2f9b82014-12-12Candidate

Name: ACOSTA, INC.
norm: acosta

Name: ACOSTA, INC.
norm: acosta
Industry: Professional Servicesllm

Discovered: Nov 11, 2014
Breach occurred: Nov 10, 2014
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmployment
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Reported the theft to local law enforcement

During the incident: Reported the theft to local law enforcement
Initiated an investigation to determine what sensitive information may have been contained on the laptop at the time of the theft
Providing access to one free year of credit monitoring and identity restoration services
Changes made: Enhancing policies and procedures relating to the security and confidentiality of Company records containing personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 12 · first

California State AGDec 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-47713
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2014
Raw hash: d8c851342df050d3be10bfb16f0d2f74c63bc69a7a48cbdf00f2f7d5c087a950

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityACOSTA, INC.

Victim entityACOSTA, INC.

Incidentdiscovered Nov 11, 2014

Stated responseReported the theft to local law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov