AccidentalProfessional ServicesProfessional ServicesMisconfigurationEmployee Data InvolvedIdentity (basic)Financial accountEmploymentLowResolved

Day & Zimmermann

bd_db75b17f5334fe3d · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 8, 2023

Filed

Oct 2, 2023

To disclose

24 days

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Day & Zimmermann →

Day & Zimmermann notified employees of a potential inadvertent exposure of personal information due to a misconfiguration in their SuccessFactors HR system. Between September 8 and September 10, 2023, a vendor update inadvertently allowed employees to view other employees' data, including home addresses, bank routing/account numbers, and tax withholding info. The issue was resolved within two days. The company offered one year of credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday24 days discovery → filing

Incident timeline

discovery → filing · 23 days

Sep 8, 2023

Begins

Sep 8, 2023

Discovered

Oct 2, 2023

Filed

vs. sector median

15 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_2973db19ee2a903e2023-10-16 · +14dCandidate

Name: Day & Zimmermann
norm: day zimmermann

Name: Day & Zimmermann
norm: day zimmermann
Industry: Professional Servicesllm

Discovered: Sep 8, 2023
Breach occurred: Sep 8, 2023 – Sep 10, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 2, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountEmployment
Attack vector: Unknown
Third party: via SuccessFactors Vendor

During the incident: Fixed the error and restored the proper restrictions in SuccessFactors
Worked with the vendor to prevent something like this from occurring in the future
Retained the assistance of TransUnion credit monitoring service
Changes made: Worked with the vendor to prevent something like this from occurring in the future
Going forward we will have the ability to determine if any employee data field was viewed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGOct 2 · first · this page

New Hampshire State AG+14d

Pattern: first filing Oct 2 (VT), last Oct 16 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-10-02-day-zimmermann-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2023
Raw hash: 6717e440ea0a9b56895aa4ebe71f02654f8bcae0f0452dccf054c85fc2845d00

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDay & Zimmermann

Victim entityDay & Zimmermann

Incidentdiscovered Sep 8, 2023

Stated responseFixed the error and restored the proper restrictions in SuccessFactors

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov