AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

SEI Private Trust Company

bd_d581b29032bdd2fb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2018

Filed

Feb 20, 2019

To disclose

12 weeks

Affected

2state residents only

Confidence

66%

Full breach record for SEI Private Trust Company →

SEI Private Trust Company experienced a security breach due to a system update on a web-based reporting tool on September 22, 2018. The issue caused authorized users to generate reports containing participant-level information (names, SSNs, account numbers) for unrelated plans. SEI discovered the issue on November 29, 2018, disabled the tool, and notified affected individuals starting February 15, 2019. Two New Hampshire residents were notified. No malicious attack was involved.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 68 days

discovery → filing · 12 weeks / 83 days

Sep 22, 2018

Begins

Nov 29, 2018

Discovered

Feb 20, 2019

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Stanadyne
norm: stanadyne
Domain: stanadyne.com

Name: SEI Private Trust Company
norm: sei private
Industry: Financial Servicesllm

Discovered: Nov 29, 2018
Breach occurred: Sep 22, 2018
Undetected for: 68 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 15, 2019
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Disabled the reporting functionality
Conducted an internal review to ascertain the scope of the problem
Contacted each of its retirement plan customers whose authorized system users may have run a report
Received written certification from customers that personnel did not misuse data
Offered each such individual, at no cost, two (2) years of Experian's ProtectMyID Alert
Changes made: Addressed the internal software coding issue
Took steps to prevent a reoccurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/stanadyne-20190220.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2019
Raw hash: 45316bdf3c08a433d4e26e7400294bb728f934b9dd311f636928973e4976c40e

Reporting entityStanadyne

Victim entitySEI Private Trust Company

Incidentdiscovered Nov 29, 2018

Stated responseDisabled the reporting functionality

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov