MalwareProfessional ServicesProfessional ServicesRansomwareVulnerability ExploitSupply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

Serco Inc.

bd_c62e19619a3fadab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 3, 2023

Filed

Aug 7, 2023

To disclose

5 weeks

Affected

8state residents only

Linked

6 filings

Confidence

66%

Full breach record for Serco Inc. →4 incidents on file

Serco, Inc. notified the NH Attorney General of a third-party breach involving benefits administrator CBIZ, Inc. CBIZ suffered a MOVEit ransomware attack (May-June 2023). Serco identified 8 NH residents whose names and government IDs may have been accessed. Serco notified residents on Aug 1, 2023, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 63 days

discovery → filing · 5 weeks / 35 days

May 1, 2023

Begins

Jul 3, 2023

Discovered

Aug 7, 2023

Filed

vs. sector median

12 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_147fd7d7262cbafd2023-08-02 · +5dVerified
California State AGbd_d3f7882faca3c5b52023-08-02 · +5dVerified
Maine State AGbd_f4de1dd0ef969c2e2023-08-02 · +5dVerified
Indiana State AGbd_81b22986e93d58cf2023-08-01 · +6dVerified

Show 1 more filing ↓up to 6d gap

Montana State AGbd_ce7497a68195b8d42023-08-01 · +6dCandidate

Name: Serco Inc.
norm: serco
Domain: serco.com

Name: Serco Inc.
norm: serco
Domain: serco.com
Industry: Professional Servicesllm

Discovered: Jul 3, 2023
Breach occurred: May 1, 2023 – Jun 5, 2023
Undetected for: 63 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 1, 2023
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via CBIZ, Inc.
Initial access: exploit_public_facing

During the incident: Promptly began an investigation and took action to address the incident with CBIZ
Information Security team is actively working with CBIZ to investigate the extent of the incident
CBIZ has informed us that a cybersecurity firm has been engaged to investigate the scope of the incident
Offering affected individuals complimentary identity theft protection and credit monitoring services through NortonLifeLock
Provided affected individuals with a phone number to call with any questions
Changes made: Ensure that CBIZ has implemented necessary security measures to prevent similar occurrences in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGAug 1 · first

Montana State AGAug 1 · first

Massachusetts State AG+1d

California State AG+1d

Maine State AG+1d

New Hampshire State AG+6d · this page

Pattern: first filing Aug 1 (IN), last Aug 7 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/serco-20230807.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2023
Raw hash: b72690966e85bd09e6a3668a65de1bf0a79a39a7d2b22d1f02ef8dc34abbda3a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySerco Inc.

Victim entitySerco Inc.

Incidentdiscovered Jul 3, 2023

Stated responsePromptly began an investigation and took action to address the incident with CBIZ

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov