HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHighContained
Brown Brothers Harriman & Co
bd_debebf402777b267 · schema v1 · pii pii-v1
Full breach record for Brown Brothers Harriman & Co →Brown Brothers Harriman & Co. (BBH) reported a data breach involving its third-party vendor, R.R. Donnelley. In December 2021, RRD experienced a systems intrusion. In March 2022, RRD informed BBH that an unauthorized party had extracted certain BBH files containing client names, addresses, Social Security numbers, and account numbers. BBH notified affected individuals, including 34 Maine residents, and provided 36 months of credit monitoring and identity restoration services through Experian.
Maine clockDiscovered Mar 4, 2022 → Filed with AG May 11, 202268d ⏱ ME AG >30d10 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_65ac691fa66c3f10Montana State AGfiled 2022-05-11Candidate
- bd_5356339cda8f7cbbNew Hampshire State AGfiled 2022-05-16(5d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c86b6f24-9c0f-4f5a-a108-85069069bb59.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 11, 2022
- Raw hash
- 3ac1c2c35f05491f70f9dba02318ca4a3494bd9fc1a415c4d623c66bf6d9464a
Reporting entity
- Name
- Brown Brothers Harriman & Conorm: brown brothers harriman
Victim entity
- Name
- Brown Brothers Harriman & Conorm: brown brothers harriman
Incident
- Discovered
- Mar 4, 2022
- Materiality determined
- —
- Notification sent
- May 23, 2022
- Affected individuals
- 2,800
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via R.R. Donnelley & Sons Company
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(68 days from discovery to filing)
- Compliance flags
- ME AG >30d · 68dME resident >60d · 80d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 4, 2022→ Filed with AG: May 11, 202268d 30 days (soft) ME AG >30d Maine Discovered: Mar 4, 2022→ Notified: May 23, 202280d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.