MisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)Financial accountHighContained

PFIZER INC.

bd_b37a8a3ce133b0f3 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 10, 2007

Filed

Aug 24, 2007

To disclose

6 weeks

Affected

34,000scope not determined

Confidence

65%

Full breach record for PFIZER INC. →8 incidents on file

Pfizer Inc notified approximately 34,000 individuals (colleagues, former employees, and healthcare professionals) of a data breach in New Hampshire. An internal employee wrongfully removed confidential data from a Pfizer computer system in late 2006. Pfizer discovered the breach on July 10, 2007. Exposed data included names, SSNs/TINs, addresses, phone numbers, credit card/bank account numbers, and government IDs. Pfizer notified law enforcement, state Attorneys General, and credit bureaus, and provided two years of free identity theft protection via IDS.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 221 days

discovery → filing · 6 weeks / 45 days

Dec 1, 2006

Begins

Jul 10, 2007

Discovered

Aug 24, 2007

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed34,000 affectedView incident

Name: PFIZER INC.
norm: pfizer
Domain: pfizer.com

Name: PFIZER INC.
norm: pfizer
Domain: pfizer.com
Industry: Healthcarellm

Discovered: Jul 10, 2007
Breach occurred: Dec 1, 2006
Undetected for: 221 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 24, 2007
Affected individuals: 34,000scope not determined
Data types: Government IDIdentity (basic)Financial account
Data elements: Date of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified the Attorney General’s office in your state of residence
Initial access: insider_action

During the incident: Notified law enforcement
Retained Identity Safeguards ("IDS") to provide two years of protection and restoration services
Advised the three major U.S. credit bureaus about this incident
Notified the Attorney General’s office in your state of residence
Changes made: Modified the computer system where this information was stored
Enhanced security for other computer systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pfizer-20070824.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 24, 2007
Raw hash: a3dc1874d41e356ff85c2f62046e9c574b1e2324c4022721d0ca390880637e19

Reporting entityPFIZER INC.

Victim entityPFIZER INC.

Incidentdiscovered Jul 10, 2007

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov