HackingManufacturingManufacturingStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedEmployee Data InvolvedCustomer Data InvolvedPIIIdentity (basic)Government IDEmploymentFinancialAuthenticationMediumContained

Northrop Grumman

bd_d31c0124f8fc82e5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 19, 2017

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

80%

Full breach record for Northrop Grumman →3 incidents on file

Equifax Workforce Solutions (TALX), the W-2 online portal provider for Northrop Grumman Systems Corporation, was accessed by unauthorized third party(ies) between April 18, 2016 and March 29, 2017. Affected data includes names, addresses, work and personal contact information, Social Security numbers, employer identification numbers, and wage/tax information from 2016 W-2 forms. Northrop Grumman disabled non-SSO portal access and coordinated with law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 18, 2016

Begins

Apr 19, 2017

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_3c2045ea7cc7ec282017-04-19Candidate
New Hampshire State AGbd_471efff6f4a020952017-04-19Verified
Massachusetts State AGbd_7cea83babb311e742017-04-19Verified

Name: Northrop Grumman
norm: northrop grumman
Domain: northropgrumman.com

Name: Northrop Grumman
norm: northrop grumman
Domain: northropgrumman.com
Industry: Manufacturingllm

Discovered: —
Breach occurred: Apr 18, 2016 – Mar 29, 2017
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDEmploymentFinancialAuthentication
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Regulator citations: Coordinating with law enforcement authorities to assist in investigation of recent incidents involving unauthorized actors gaining access to individuals' personal information through the W-2 online portal
Third party: via Equifax Workforce Solutions (TALX)
Initial access: valid_credentials

During the incident: Worked with Equifax to determine the details of the issue
Disabled online access to the W-2 online portal for all log-in methods other than Single Sign On, which is available only from the Northrop Grumman network
Coordinating with law enforcement authorities to assist them in their investigation
Arranged with Equifax to offer three years of ID Patrol identity theft protection services at no cost to affected individuals
Changes made: Restricted W-2 online portal access to Single Sign On available only from the Northrop Grumman network
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGApr 19 · first

New Hampshire State AGApr 19 · first

Massachusetts State AGApr 19 · first

California State AGApr 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-67691
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 19, 2017
Raw hash: de0097bb93d326278366b9930f4e190bf2759b5aa790d513f930a15c47af0ffa

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNorthrop Grumman

Victim entityNorthrop Grumman

IncidentThird-Party / Supply Chain

Stated responseWorked with Equifax to determine the details of the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov