MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedEmploymentHealth (basic)Identity (basic)Government IDPHIPIIHighContained

RUSSELL INVESTMENTS CAPITAL, LLC

bd_ab072dd7acabb19a · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 22, 2017

Filed

Mar 7, 2017

To disclose

13 days

Affected

1,291state residents only

Linked

3 filings

Confidence

70%

Full breach record for RUSSELL INVESTMENTS CAPITAL, LLC →

Russell Investments reported an insider data breach on Feb 22, 2017, where an employee sent PII of associates and dependents to a personal Gmail account. 1,291 Washington residents affected. Data included SSNs, DOBs, and employment data. Company recovered data, reset credentials, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 days

Feb 22, 2017

Begins

Feb 22, 2017

Discovered

Mar 7, 2017

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_070b3b9433c9c6f52017-03-07Verified
Massachusetts State AGbd_0fbdf552fd581edf2017-03-07Verified

Name: RUSSELL INVESTMENTS CAPITAL, LLC
norm: russell investments

Name: RUSSELL INVESTMENTS CAPITAL, LLC
norm: russell investments
Industry: Financial Servicesllm

Discovered: Feb 22, 2017
Breach occurred: Feb 22, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,291state-resident count only
Data types: PIIIdentity (basic)Government IDEmploymentHealth (basic)
Data elements: Health insurance IDDate of birthSocial Security numberName
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1052 Exfiltration Over Physical Medium
Threat actor: Internal
Initial access: insider_action

During the incident: Information Security and Incident Response team met daily
Identified the breached PII and where it could see to have been stored or saved outside of Russell Investments’ systems
Recovered the breached PII from the associate who caused the data breach
Deleted all known copies of the breached PII stored outside of Russell Investments’ systems
Resetting key passwords and other credentials
Changes made: Considering revisions to human resources’ policies
Considering revisions to IT polices related to privileged systems access by associates
Considering implementing new data loss prevention functionality in our computer systems
Considering blocking access to unapproved online storage services
Considering enhancements to our virtual private network used for remote access to associates’ work environments
Providing credit monitoring for two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 7 · first

Massachusetts State AGMar 7 · first

Washington State AGMar 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9683.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 7, 2017
Raw hash: 16ac941e7bc0767730d7436b8d22860bb25ee561149bb9b95041403100d953f5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityRUSSELL INVESTMENTS CAPITAL, LLC

Victim entityRUSSELL INVESTMENTS CAPITAL, LLC

Incidentdiscovered Feb 22, 2017

Stated responseInformation Security and Incident Response team met daily

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com