AccidentalProfessional ServicesProfessional ServicesMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancialMediumResolved

PRICEWATERHOUSECOOPERS LLP

bd_bc2db9ce7beccd54 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 14, 2020

Filed

Oct 15, 2020

To disclose

4 weeks

Affected

2state residents only

Linked

2 filings

Confidence

67%

Full breach record for PRICEWATERHOUSECOOPERS LLP →3 incidents on file

PricewaterhouseCoopers LLP notified the NH Attorney General that on September 14, 2020, an employee inadvertently emailed tax information and SSNs for 2 NH residents to the wrong recipient due to a typo. PwC revoked access, retrained staff, and offered 24 months of Equifax identity theft prevention services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 31 days

Sep 14, 2020

Discovered

Oct 15, 2020

Filed

vs. sector median

13 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_19861585d41427f22020-10-12 · +3dVerified

Name: PRICEWATERHOUSECOOPERS LLP
norm: pricewaterhousecoopers

Name: PRICEWATERHOUSECOOPERS LLP
norm: pricewaterhousecoopers
Industry: Professional Servicesllm

Discovered: Sep 14, 2020
Materiality determined: —
Notification sent: Oct 12, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Unknown
Threat actor: Internal

During the incident: The individual at PwC responsible for this issue has been removed from the Brookside account and that individual's access to Brookside information has been revoked
The remaining members of the Brookside account team will receive re-training on our privacy and data protection policies
Working with our internal information security team to set-up monitoring of suspicious websites for the file that was sent inadvertently to the incorrect email address
Sent a further communication to the recipient email address indicating that the message was sent in error and requesting that it be deleted
Changes made: Offering the individuals 24 months of Equifax services
Re-training on privacy and data protection policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 12 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pricewaterhousecoopers-20201015.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2020
Raw hash: 8d2325f4e6c142d02f6eabad327e33cd161c4880f16053fda7072ecce13578c0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPRICEWATERHOUSECOOPERS LLP

Victim entityPRICEWATERHOUSECOOPERS LLP

Incidentdiscovered Sep 14, 2020

Stated responseThe individual at PwC responsible for this issue has been removed from the Brookside account and that individual's access to Brookside information has been revoked

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov