AccidentalFinancial ServicesProfessional ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

ITT Corporation

bd_b3ed21fd2f3dbdd1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Dec 27, 2010

To disclose

—

Affected

9state residents only

Linked

2 filings

Confidence

67%

Marsh U.S. Consumer notified NH AG of a data security incident involving ITT Corporation employees. A programming error and incorrect URLs allowed unauthorized viewing of unencrypted personal info (SSNs, medical history) for 9 NH residents between Nov 1-8, 2010. No third-party misuse known. Affected individuals were alerted.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 1, 2010

Begins

Dec 27, 2010

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_71ebbd9af3e689802010-12-30 · +3dVerified

Name: Marsh US Consumer
norm: marsh us consumer

Name: ITT Corporation
norm: itt
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: —
Breach occurred: Nov 1, 2010 – Nov 8, 2010
Materiality determined: —
Notification sent: —
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Notified New Hampshire Attorney General

During the incident: Remedied and fixed the underlying programming issue
Investigated the incident and analyzed the potential impact
Notified ITT of the results of its investigation and analysis
Alerting potentially affected individuals about the situation
Notifying the three major credit reporting repositories (Experian, Equifax and TransUnion)
Changes made: Fixed the underlying programming issue
Corrected the communication of incorrect enrollment website URLs
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 27 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/marsh-us-consumer-20101227.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 27, 2010
Raw hash: 3fb39013726098f62a93afaa8570bd8856d769073926124aad2fd3e56a258b6e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMarsh US Consumer

Victim entityITT Corporation

IncidentMisconfiguration

Stated responseRemedied and fixed the underlying programming issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov