HackingManufacturingManufacturingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIIdentity (basic)Government IDMediumContained

INTERNATIONAL PAPER COMPANY

bd_b69efa0988599a97 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 26, 2023

Filed

Nov 20, 2023

To disclose

17 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for INTERNATIONAL PAPER COMPANY →

International Paper Company notified the California AG of a data breach affecting its Group Health and Welfare Plan participants. The incident occurred on May 30, 2023, when an unauthorized actor exploited a vulnerability in Progress Software's MOVEit Transfer tool used by third-party vendor Welltok, Inc. Welltok discovered the potential impact on July 26, 2023, and confirmed data exfiltration. Affected data includes personal information and electronic protected health information (ePHI). Welltok is offering 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 57 days

discovery → filing · 17 weeks / 117 days

May 30, 2023

Begins

Jul 26, 2023

Discovered

Nov 20, 2023

Filed

This filing is one of 6 filings about the same incident.View merged incident

Part of Welltok supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

South Carolina State AGbd_85ce2c38db68f19f2023-11-22 · +2dVerified
Washington State AGbd_a5aa7fd99593aae02023-11-17 · +3dCandidate
HHS OCRbd_fa9ed67c4099f5a92023-11-14 · +6dCandidate
Massachusetts State AGbd_887c1be2a2f7ef7b2023-11-29 · +9dVerified

Show 1 more filing ↓up to 14d gap

Oregon State AGbd_d26294b2742f60492023-12-04 · +14dVerified

Name: INTERNATIONAL PAPER COMPANY
norm: international paper

Name: INTERNATIONAL PAPER COMPANY
norm: international paper
Industry: Manufacturingllm

Discovered: Jul 26, 2023
Breach occurred: May 30, 2023
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Welltok, Inc.
Initial access: supply_chain

During the incident: Installed all published patches upon learning of the vulnerability
Conducted an investigation to determine the potential impact on the MOVEit Transfer server
Reviewed data stored on the server at the time of this incident
Coordinating efforts with the IP Plan to review and verify the affected information
Providing direct notice to impacted individuals
Providing access to 24 months of credit monitoring and identity protection services provided by Experian
Changes made: Reviewing and enhancing existing policies and procedures related to data privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

HHS OCRNov 14 · first

Washington State AG+3d

California State AG+6d · this page

South Carolina State AG+8d

Massachusetts State AG+15d

Oregon State AG+20d

Pattern: first filing Nov 14 (TN), last Dec 4 (OR) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-576801
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 20, 2023
Raw hash: 63f6ea7b251e4f90b048266ad74861a26eda2c2570dca870fe6508210bdf1ad6

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityINTERNATIONAL PAPER COMPANY

Victim entityINTERNATIONAL PAPER COMPANY

Incidentdiscovered Jul 26, 2023

Stated responseInstalled all published patches upon learning of the vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov