Social EngineeringOtherPhishingData ExfiltratedIdentity (basic)Government IDMediumContained

World Relief Corporation of National Association of Evangelicals

bd_b7468845c87f2d1d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 27, 2019

Filed

Sep 20, 2019

To disclose

24 days

Affected

3state residents only

Linked

2 filings

Confidence

66%

Full breach record for World Relief Corporation of National Association of Evangelicals →

World Relief Corporation notified NH AG of a phishing incident affecting 3 NH residents. Unauthorized access to employee email accounts occurred between April 4 and May 21, 2019. Personal info (name, SSN, or DL) was viewed. Notification sent Sept 19, 2019. Remediation included security measures, employee training, and 1 year of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 145 days

discovery → filing · 24 days

Apr 4, 2019

Begins

Aug 27, 2019

Discovered

Sep 20, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_de4d0746a10d12c32019-09-19 · +1dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: World Relief Corporation of National Association of Evangelicals
norm: world relief corporation of national association of evangelicals
Industry: Otherllm

Discovered: Aug 27, 2019
Breach occurred: Apr 4, 2019 – May 21, 2019
Undetected for: 145 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 19, 2019
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email CollectionT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Took steps to secure the account
Launched an internal investigation
Engaged a leading cyber security firm to assist in the investigation
Conducted a comprehensive review of those messages
Established a dedicated call center
Offering one year of complimentary credit monitoring and identity theft protection services through Kroll
Changes made: Implementing additional safeguards and technical security measures
Providing additional training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGSep 19 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/world-relief-20190920.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2019
Raw hash: 8a866d010ef3682b6add32700a5ffb7b91e18091917d1323fb4510d780c971ff

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityWorld Relief Corporation of National Association of Evangelicals

Incidentdiscovered Aug 27, 2019

Stated responseTook steps to secure the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov