PhysicalHealthcareHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

BRISTOL-MYERS SQUIBB COMPANY

bd_b5dd0f20652c6607 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 4, 2008

Filed

Jul 11, 2008

To disclose

5 weeks

Affected

458state residents only

Linked

2 filings

Confidence

67%

Full breach record for BRISTOL-MYERS SQUIBB COMPANY →7 incidents on file

Bristol-Myers Squibb Company notified the New Hampshire Attorney General that a backup data tape containing employee and dependent PII (including SSNs, bank account numbers, and employment data) was stolen during transport. The incident was discovered on June 4, 2008. Approximately 458 New Hampshire residents were affected. BMS offered one year of free credit monitoring and identity theft insurance.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 37 days

Jun 4, 2008

Discovered

Jul 11, 2008

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_76596fb9141b4a722008-07-14 · +3dVerified

Name: BRISTOL-MYERS SQUIBB COMPANY
norm: bristol myers squibb
Domain: bms.com

Name: BRISTOL-MYERS SQUIBB COMPANY
norm: bristol myers squibb
Domain: bms.com
Industry: Healthcarellm

Discovered: Jun 4, 2008
Materiality determined: —
Notification sent: Jul 12, 2008
Affected individuals: 458state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General Consumer Protection and Antitrust Bureau

During the incident: Initiated an investigation of this incident
Providing written notice to all such affected individuals
Made arrangements to offer free credit monitoring and identity theft insurance to these individuals for one year
Changes made: Enhancing security protocols regarding the handling of personal information and our back-up data tapes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJul 11 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bristol-myers-squibb-20080711.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2008
Raw hash: 08b9c1c35b22d1026bb56b6501db63c85f5942a9c8990071b6be1c73f47dab20

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBRISTOL-MYERS SQUIBB COMPANY

Victim entityBRISTOL-MYERS SQUIBB COMPANY

Incidentdiscovered Jun 4, 2008

Stated responseInitiated an investigation of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov