AccidentalTechnologyInformationMisdeliveryEmployee Data InvolvedPIIIdentity (basic)Government IDFinancial accountHighResolved

ARINC, Incorporated

bd_bf733cc9d64fa2ef · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 17, 2019

Filed

Nov 20, 2019

To disclose

5 weeks

Affected · nationwide

1,5006 in this filing

Linked

3 filings

Confidence

66%

Full breach record for ARINC, Incorporated →

ARINC Incorporated (Collins Aerospace) notified Washington AG that a processing error on Oct 7, 2019, caused W-2 forms containing PII and SSNs to be accidentally emailed to a former employee instead of the intended recipient. 1,500 employees were potentially affected, with 6 in Washington. Recipient deleted data. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 10 days

discovery → filing · 5 weeks / 34 days

Oct 7, 2019

Begins

Oct 17, 2019

Discovered

Nov 20, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_1217461e3eb777fd2019-11-20Verified
Oregon State AGbd_73194eb40add7b3b2019-11-20Candidate

Name: Crowell & Moring LLP
norm: crowell moring

Name: ARINC, Incorporated
norm: arinc
Industry: Technologyllm

Discovered: Oct 17, 2019
Breach occurred: Oct 7, 2019
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2019
Affected individuals: 1,500state + nationwide
Data types: PIIIdentity (basic)Government IDFinancial account
Attack vector: Misconfiguration
Regulator citations: Notified Washington State Office of the Attorney General

During the incident: Contacted the recipient of the data and requested that the information be deleted
Obtained written statement confirming deletion and non-retention of data
Hired IDExperts to offer impacted individuals one year of complimentary MyIDCare services
Changes made: Re-examining processing procedures to prevent reoccurrence
Putting forth other safeguards to better serve data protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 20 · first

Oregon State AGNov 20 · first

Washington State AGNov 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10519.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 20, 2019
Raw hash: c5fb8840f5593b6cae40f94dbea78855466d1e11203b499d49f7c75fa0ff4268

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCrowell & Moring LLP

Victim entityARINC, Incorporated

Incidentdiscovered Oct 17, 2019

Stated responseContacted the recipient of the data and requested that the information be deleted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com