MisuseProfessional ServicesProfessional ServicesData MishandlingEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

ICF

bd_caa66a1450f987b2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 10, 2018

Filed

Mar 2, 2018

To disclose

20 days

Affected

900

Confidence

66%

Full breach record for ICF →

ICF reported an unauthorized access incident on March 2, 2018, pursuant to New Hampshire law. On February 8, 2018, an authorized employee accidentally emailed a file containing W-2 statements for approximately 900 current and former employees to an unauthorized recipient. The recipient deleted the file and notified ICF on February 10, 2018. The data exposed included names, addresses, SSNs, and earnings. 14 affected individuals were New Hampshire residents. ICF offered credit monitoring and ID theft services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 20 days

Feb 8, 2018

Begins

Feb 10, 2018

Discovered

Mar 2, 2018

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed900 affectedView incident

Name: ICF
norm: icf
Domain: icf.com

Name: ICF
norm: icf
Domain: icf.com
Industry: Professional Servicesllm

Discovered: Feb 10, 2018
Breach occurred: Feb 8, 2018
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 2, 2018
Affected individuals: 900state + nationwide
Data types: Identity (basic)Government IDFinancial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Regulator citations: Notified NH Department of Justice pursuant to NH Rev Stat §359-C:20
Initial access: insider_action

During the incident: Appropriately notifying the affected employees regarding this issue
Verifying the ICF Recipient deleted the W-2 statements from the ICF Recipient's email account
Verifying the email containing the W-2 statements does not exist on other unauthorized systems or devices
Verifying the ICF Recipient did not forward the email outside of the ICF email system
Reinforcing our established data privacy and data security safeguards within the department which inadvertently disclosed the information to prevent similar future situations
Offered all affected employees data protection safeguards such as credit monitoring and identify theft services
Changes made: Reinforcing our established data privacy and data security safeguards within the department which inadvertently disclosed the information to prevent similar future situations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/icf-20180302.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2018
Raw hash: 44706882d6c1098d4ced30fe54b4a4ccda3bf8a870d9d84e9aaee59699697746

Reporting entityICF

Victim entityICF

Incidentdiscovered Feb 10, 2018

Stated responseAppropriately notifying the affected employees regarding this issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov