HackingProfessional ServicesTechnologyProfessional ServicesStolen CredentialsData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedTargetedIdentity (basic)Government IDEmploymentMediumActive

Kroll Background Screening Services (Kroll)

bd_bb683b5e87ecdc63 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 25, 2013

Filed

Nov 26, 2013

To disclose

9 weeks

Affected

86state residents only

Linked

5 filings

Confidence

66%

Full breach record for Kroll Background Screening Services (Kroll) →

Kroll Background Screening Services experienced a third-party cyber intrusion between June and September 2013. Marsh & McLennan Companies notified the NH AG that personal data (SSN, name, address, employment history) of 86 NH residents may have been accessed. Kroll is under federal criminal investigation. Affected individuals were offered 2 years of credit monitoring via AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 116 days

discovery → filing · 9 weeks / 62 days

Jun 1, 2013

Begins

Sep 25, 2013

Discovered

Nov 26, 2013

Filed

vs. sector median

10 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_d1c97559aca93f132013-11-26Verified
Massachusetts State AGbd_2b2299354c2eeccb2013-11-27 · +1dVerified
California State AGbd_4e8cd52ff7211abb2013-11-21 · +5dCandidate
New Hampshire State AGbd_92d69016493a2df92013-11-20 · +6dVerified

Name: MARSH & MCLENNAN COMPANIES, INC.
norm: marsh mclennan companies

Name: Kroll Background Screening Services (Kroll)
norm: kroll background screening services kroll
Industry: Professional ServicesllmTechnologyllm

Discovered: Sep 25, 2013
Breach occurred: Jun 1, 2013 – Sep 15, 2013
Undetected for: 116 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 26, 2013
Affected individuals: 86state-resident count only
Data types: Identity (basic)Government IDEmployment
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified state regulators and law enforcement officials, as appropriate
Initial access: supply_chain

During the incident: Notified law enforcement officials
Notified the three national credit bureaus — Experian, Equifax, and TransUnion
Offered complimentary credit protection services for two years
Arranged to have AllClear ID provide identity protection services at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

New Hampshire State AGNov 20 · first

California State AG+1d

California State AG+6d

New Hampshire State AG+6d · this page

Massachusetts State AG+7d

Pattern: first filing Nov 20 (NH), last Nov 27 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kroll-background-20131126.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2013
Raw hash: dd7d4c05b77a5de63810d7a2479b532a92bef28d514b0731a63dd8073ca5fc38

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMARSH & MCLENNAN COMPANIES, INC.

Victim entityKroll Background Screening Services (Kroll)

Incidentdiscovered Sep 25, 2013

Stated responseNotified law enforcement officials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov