AccidentalFinancial ServicesFinanceMisdeliveryData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDEmploymentMediumContained

IndyMac Resources, Inc.

bd_d995b9dae2f6b42a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 2, 2012

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for IndyMac Resources, Inc. →

IndyMac Resources, Inc. disclosed that PII of former employees was exposed on a public web server between 2007 and 2011. A contractor's employee placed the data, which included names, SSNs, and birth dates, on the server. The data was subsequently removed. The company offered two years of free credit monitoring via Equifax and established a hotline for affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 1, 2007

Begins

Feb 2, 2012

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_094f7d8b7bdbb7be2012-01-30 · +3dVerified

Name: IndyMac Resources, Inc.
norm: indymac resources

Name: IndyMac Resources, Inc.
norm: indymac resources
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jan 1, 2007 – Dec 31, 2011
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Regulator citations: Submitted Breach Notification to California Office of the Attorney General
Initial access: trusted_relationship

During the incident: Arranged for Equifax to provide two years of credit monitoring services at no cost
Established a hotline for questions ([REDACTED-PHONE])
Removed the data from the public web server
Changes made: Provided resources for identity theft protection
Encouraged consumers to order free credit reports and review for suspicious activity
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 30 · first

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-22262
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 2, 2012
Raw hash: 5aa9f96787e42f7813a086d35ebf2ad95bf3f59c8c996c50d06a6b0303075be2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityIndyMac Resources, Inc.

Victim entityIndyMac Resources, Inc.

IncidentThird-Party / Supply Chain

Stated responseArranged for Equifax to provide two years of credit monitoring services at no cost

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov