HackingTechnologyFinancial ServicesInformationStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancialHealth (basic)MediumContained

TALX

bd_acb4d06ef532e913 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 26, 2017

Filed

Jul 21, 2017

To disclose

25 days

Affected

12state residents only

Linked

3 filings

Confidence

66%

Full breach record for TALX →4 incidents on file

TALX Corporation, a payroll services provider, notified the NH Attorney General of a data security incident affecting 12 NH residents (employees/family of Whole Foods Market). Unauthorized third parties accessed online portal accounts between April 2016 and April 2017 by answering personal security questions to reset PINs. Exposed data included W-2s, 1095-Cs, SSNs, names, addresses, and health insurance info. TALX notified law enforcement/IRS, enhanced security, disabled personal questions, and offered 2 years of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 434 days

discovery → filing · 25 days

Apr 18, 2016

Begins

Jun 26, 2017

Discovered

Jul 21, 2017

Filed

vs. sector median

7 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_aae62765d402c75e2017-07-17 · +4dCandidate
Massachusetts State AGbd_2913de600522d86a2017-07-03 · +18dCandidate

Name: TALX
norm: talx

Name: TALX
norm: talx
Industry: TechnologyllmFinancial Servicesllm

Discovered: Jun 26, 2017
Breach occurred: Apr 18, 2016 – Apr 23, 2017
Undetected for: 434 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 20, 2017
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government IDFinancialHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementNotified the Internal Revenue Service (IRS)Notified state tax authorities
Initial access: valid_credentials

During the incident: Notified federal law enforcement, the Internal Revenue Service (IRS), and state tax authorities
Implemented additional security measures, including enhanced fraud monitoring
Removed the personal questions as an option to reset PINs from the online portal
Reset potentially affected employees’ PINs
Removed unverified contact information (email addresses and phone numbers) associated with employees’ accounts
Added valid contact information from Whole Foods for the purpose of utilizing one-time passcodes as part of multi-factor authentication
Notified by mail the 12 New Hampshire residents who may have been affected
Offered two years of ID Patrol identity protection service free of charge
Changes made: Implemented enhanced fraud monitoring
Disabled authentication by personal questions
Added valid contact information from Whole Foods for the purpose of utilizing one-time passcodes as part of multi-factor authentication
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Massachusetts State AGJul 3 · first

Massachusetts State AG+14d

New Hampshire State AG+18d · this page

Pattern: first filing Jul 3 (MA), last Jul 21 (NH) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/talx-20170721.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2017
Raw hash: 54757235f2b186258745c122be66e3735faee7803318a198b84666a8e22ae98b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTALX

Victim entityTALX

Incidentdiscovered Jun 26, 2017

Stated responseNotified federal law enforcement, the Internal Revenue Service (IRS), and state tax authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov