HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
INTERNATIONAL PAPER COMPANY
bd_b69efa0988599a97 · schema v1 · pii pii-v1
Full breach record for INTERNATIONAL PAPER COMPANY →International Paper Company notified the California AG of a data breach affecting its Group Health and Welfare Plan participants. The incident occurred on May 30, 2023, when an unauthorized actor exploited a vulnerability in Progress Software's MOVEit Transfer tool used by third-party vendor Welltok, Inc. Welltok discovered the potential impact on July 26, 2023, and confirmed data exfiltration. Affected data includes personal information and electronic protected health information (ePHI). Welltok is offering 24 months of credit monitoring via Experian.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_a5aa7fd99593aae0Washington State AGfiled 2023-11-17(3d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-576801
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 20, 2023
- Raw hash
- 63f6ea7b251e4f90b048266ad74861a26eda2c2570dca870fe6508210bdf1ad6
Reporting entity
- Name
- INTERNATIONAL PAPER COMPANYnorm: international paper
Victim entity
- Name
- INTERNATIONAL PAPER COMPANYnorm: international paper
Incident
- Discovered
- Jul 26, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Welltok, Inc.
- Initial access
- supply_chain
Compliance
- Time to disclose
- 17 weeks(117 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.