HackingFinancial ServicesFinanceStolen CredentialsDelayed DiscoveryTargetedIdentity (basic)Government IDMediumActive

Freddie Mac

bd_cd2b5642b5672bba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2014

Filed

Sep 19, 2016

To disclose

30 months

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Freddie Mac →3 incidents on file

Freddie Mac notified the NH Attorney General that unauthorized access to Freddie Mac Pension Plan participant data (names, SSNs, DOBs) occurred in April 2013. Freddie Mac learned of the incident in April 2014 via law enforcement. In August 2016, law enforcement provided additional info that the attackers accessed a few additional participants' data. Notifications were sent to NH residents.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 365 days

discovery → filing · 30 months / 902 days

Apr 1, 2013

Begins

Apr 1, 2014

Discovered

Sep 19, 2016

Filed

vs. sector median

+121 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_df564097824da7fb2016-09-21 · +2dVerified

Name: Freddie Mac
norm: freddie mac
Domain: freddiemac.com

Name: Freddie Mac
norm: freddie mac
Domain: freddiemac.com
Industry: Financial Servicesllm

Discovered: Apr 1, 2014
Breach occurred: Apr 1, 2013
Undetected for: 365 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified State of New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Sent notification letters out to all Pension Plan participants
Cooperated with law enforcement
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 months(902 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGSep 19 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/freddie-mac-20160919.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2016
Raw hash: 524cffee1cb830b3eb5cd2c6908e3bb225b17f97c05f534fc86e7f5b622006e8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFreddie Mac

Victim entityFreddie Mac

Incidentdiscovered Apr 1, 2014

Stated responseSent notification letters out to all Pension Plan participants

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov