HackingStolen CredentialsCapture Stored DataData ExfiltratedEmployee Data InvolvedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)PIIPHIMediumContained

STEEL PARTNERS HOLDINGS L.P.

bd_d278d119b9afcdc0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 16, 2020

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

75%

Full breach record for STEEL PARTNERS HOLDINGS L.P. →2 incidents on file

Steel Partners discovered unauthorized access to one employee email account, allowing a local download of the entire mailbox. The breach occurred April 18–29, 2020, with PII determined to be involved on May 29, 2020. Exposed data included names, SSNs, dates of birth, and health information (disability/workers' compensation). Notification letters were sent June 29, 2020, with two-year Experian IdentityWorks credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 18, 2020

Begins

May 29, 2020

Scope determined

Jul 16, 2020

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_25cb6bbe7680f0202020-07-16Verified
New Hampshire State AGbd_d994bde2b3fef2842020-07-30 · +14dVerified
California State AGbd_3ca7167cc02cf4962020-08-02 · +17dVerified
Montana State AGbd_6be8759b2eb0d3482020-06-29 · +17dCandidate

Show 3 more filings ↓up to 17d gap

South Carolina State AGbd_88361305fd97eb212020-06-29 · +17dVerified
Indiana State AGbd_d1792ff303bb51542020-06-29 · +17dVerified
Delaware State AGbd_d8b05cdca0e423622020-06-29 · +17dVerified

Name: STEEL PARTNERS HOLDINGS L.P.
norm: steel partners

Name: STEEL PARTNERS HOLDINGS L.P.
norm: steel partners

Discovered: —
Breach occurred: Apr 18, 2020 – Apr 29, 2020
Materiality determined: May 29, 2020
Notification sent: Jun 29, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PIIPHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External

During the incident: Immediately initiated an investigation
Locked the compromised email account
Engaged a forensic security firm to assist
Conducted a broader review of our network and confirmed that only one email account was impacted
Requiring a password reset for our employees
Offering a complimentary two-year subscription to Experian IdentityWorks credit monitoring and identity theft protection service
Changes made: Implemented changes to our login process
Implemented stricter multi-factor authentication rules
Continue to work with the forensic security firm to further strengthen our existing security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Montana State AGJun 29 · first

South Carolina State AGJun 29 · first

Indiana State AGJun 29 · first

Delaware State AGJun 29 · first

Massachusetts State AG+17d

California State AG+17d · this page

New Hampshire State AG+31d

California State AG+34d

Pattern: first filing Jun 29 (MT), last Aug 2 (CA) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192098
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2020
Raw hash: cd0579f3902894e86590dea1f57226a25acf41698ffdd7ce2a93fd3b65370885

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entitySTEEL PARTNERS HOLDINGS L.P.

Victim entitySTEEL PARTNERS HOLDINGS L.P.

IncidentUnauthorized Access

Stated responseImmediately initiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov