HackingProfessional ServicesTechnologyProfessional ServicesStolen CredentialsBECSupply Chain (3P Vendor)Employee Data InvolvedData ExfiltratedGovernment IDIdentity (basic)EmploymentMediumContained

Human Resources Concepts, LLC

bd_b5bc35f272c7c9ce · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 10, 2018

Filed

Mar 12, 2019

To disclose

13 weeks

Affected · nationwide

32855 in this filing

Confidence

66%

Human Resources Concepts (HRC), a third-party employee benefits provider, suffered a business email compromise on December 10, 2018, when an unauthorized actor accessed an employee's email account. The actor obtained a password-protected file containing PII (SSN, name, address, etc.) for 328 individuals, primarily employees of client Skillsoft, along with the password to decrypt it. HRC contained the incident and notified Skillsoft. Skillsoft notified affected employees and relevant state AGs. HRC notified the NH AG on March 12, 2019. 55 New Hampshire residents were affected.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 92 days

Dec 10, 2018

Discovered

Mar 12, 2019

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed328 affectedView incident

Name: Human Resources Concepts, LLC
norm: human resources concepts
Domain: hrconnects.com

Name: Human Resources Concepts, LLC
norm: human resources concepts
Domain: skillsoft.com
Industry: Professional ServicesllmTechnologyllm

Discovered: Dec 10, 2018
Materiality determined: —
Notification sent: Dec 21, 2018
Affected individuals: 328state + nationwide
Data types: Government IDIdentity (basic)Employment
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Third party: via Human Resources Concepts, LLC
Initial access: valid_credentials

During the incident: HRC's IT vendor quickly detected the incident and promptly ended the unauthorized access
HRC notified Skillsoft of this incident on December 20, 2018
Skillsoft notified its 325 affected employees of the incident on December 21, 2018
Skillsoft notified Attorneys General for states of residence of the affected employees on or about January 23, 2019
HRC notified the New Hampshire Attorney General of this data security incident on March 12, 2019
Changes made: Retaining an external computer forensic company to conduct a multifaceted security assessment
Engaging an IT vendor to provide regular consultation on network security matters
Implemented a policy with its clients and staff that prohibits the exchange of file passwords using the same method of transmission of the files
Instituting an information security training plan for its staff to reinforce best practices
Skillsoft implemented additional security measures designed to prevent a recurrence
Skillsoft is providing you the opportunity to protect your identity with PrivacyArmor Plus, InfoArmor's identity and privacy protection plan, free of charge for one (1) year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/human-resources-concepts-20190312.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2019
Raw hash: 1b81b77daf6849a8ec9f6d247aed6ae258eb7257f314893dfb1f39e81a76852b

Reporting entityHuman Resources Concepts, LLC

Victim entityHuman Resources Concepts, LLC

Incidentdiscovered Dec 10, 2018

Stated responseHRC's IT vendor quickly detected the incident and promptly ended the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov