HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsMediumContained

talentReef Inc

bd_c271081b5572348b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2017

Filed

Jan 10, 2018

To disclose

6 weeks

Affected

604state residents only

Linked

5 filings

Confidence

68%

Full breach record for talentReef Inc →

talentReef, Inc. notified Washington AG that on Nov 29, 2017, unauthorized access to an employee email account occurred. Data exposed included names, addresses, driver's licenses, SSNs, and payment card details (including CVV) for 604 Washington residents. Notifications sent Jan 9, 2018; ID protection offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 42 days

Nov 29, 2017

Discovered

Jan 10, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_0d3d9378bd39536f2018-01-10Verified
Massachusetts State AGbd_129abea3e0a28a552018-01-10Verified
New Hampshire State AGbd_df4e97d1a086d73c2018-01-10Verified
Montana State AGbd_f5bca5716c27c3212018-01-09 · +1dCandidate

Name: BakerHostetler LLP
norm: bakerhostetler

Name: talentReef Inc
norm: talentreef
Industry: Technologyllm

Discovered: Nov 29, 2017
Materiality determined: —
Notification sent: Jan 9, 2018
Affected individuals: 604state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Data elements: NameSocial Security numberDriver's licence numberFinancial account number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Immediately reset passwords
Began an investigation
Hired an outside forensic investigation firm to assist in their investigation
Began notifying individuals by U.S. Mail
Offering affected individuals one year of identity theft protection services through ID Experts
Changes made: Enhance their existing security protocols
Re-educating their employees regarding the protection of sensitive information
Increase the security strength of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJan 9 · first

California State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+1d

Washington State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9760.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2018
Raw hash: 66142c815516290a3c1124e2574cbc43040f25488b40bbe490ce7cb9ed241331

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBakerHostetler LLP

Victim entitytalentReef Inc

Incidentdiscovered Nov 29, 2017

Stated responseImmediately reset passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com