AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Trustmark Mutual Holding Company

bd_cbd4dde28df412a6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 14, 2015

Filed

Jun 22, 2015

To disclose

6 weeks

Affected

21state residents only

Linked

4 filings

Confidence

66%

Trustmark Mutual Holding Company notified NH AG of a data security event where a software error on May 13, 2015, caused encrypted billing emails to be sent to insurance carrier clients with attachments containing PII (names, SSNs, payroll data) of insureds from other carriers. Trustmark discovered the error on May 14, recalled emails, and notified 21 NH residents. Remediation included fixing the error and offering 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 6 weeks / 39 days

May 13, 2015

Begins

May 14, 2015

Discovered

Jun 22, 2015

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_1a66194c6ea5966c2015-06-22Candidate
South Carolina State AGbd_35d3cec9ec1ffb6b2015-06-29 · +7dVerified
Massachusetts State AGbd_f1d6160894b297d72015-06-29 · +7dVerified

Name: Trustmark Mutual Holding Company
norm: trustmark mutual holding
Domain: trustmarkbenefits.com

Name: Trustmark Mutual Holding Company
norm: trustmark mutual holding
Domain: trustmarkbenefits.com
Industry: Financial Servicesllm

Discovered: May 14, 2015
Breach occurred: May 13, 2015
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jun 22, 2015
Affected individuals: 21state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Provided notice to New Hampshire Attorney GeneralProvided written notice to other state regulators departments of insurance

During the incident: Launched an investigation into the incident
Took steps to recall the email messages
Identified and corrected the software error that caused this incident
Implemented safeguards to ensure it does not occur again
Working diligently with the insurance carrier recipients
Performed a thorough review of the contents of each encrypted email
Provided written notice of this incident to affected individuals
Offered access to two (2) free years of credit monitoring and identity restoration services
Providing written notice of this incident to its impacted clients, other state regulators departments of insurance, and consumer reporting agencies
Changes made: Identified and corrected the software error that caused this incident
Implemented safeguards to ensure it does not occur again
Review of the Trustmark’s policies and procedures relating to the security and confidentiality of Trustmark records containing personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGJun 22 · first

New Hampshire State AGJun 22 · first · this page

South Carolina State AG+7d

Massachusetts State AG+7d

Pattern: first filing Jun 22 (CA), last Jun 29 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/trustmark-mutual-20150622.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2015
Raw hash: fa8af36ecae4e1acc5cc631b6125f52ff8c9aa9fb44a7fbf761fae9851ce07e8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTrustmark Mutual Holding Company

Victim entityTrustmark Mutual Holding Company

Incidentdiscovered May 14, 2015

Stated responseLaunched an investigation into the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov