AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

FPI Management

bd_df819882539d3d39 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 31, 2017

Filed

Apr 10, 2017

To disclose

10 weeks

Affected

1state residents only

Confidence

65%

Full breach record for FPI Management →3 incidents on file

FPI Management, Inc. disclosed that between Jan 19-27, 2017, Form 1099s containing names, addresses, phone numbers, and SSNs were inadvertently mailed in wrong envelopes to contractors. Discovered Jan 31, 2017. No evidence of misappropriation. Kroll provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

discovery → filing · 10 weeks / 69 days

Jan 19, 2017

Begins

Jan 31, 2017

Discovered

Apr 10, 2017

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: FPI
norm: fpi
Domain: fpi.org

Name: FPI Management
norm: fpi management
Industry: Financial Servicesllm

Discovered: Jan 31, 2017
Breach occurred: Jan 19, 2017 – Jan 27, 2017
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 31, 2017
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium

During the incident: Offering credit and identity monitoring services for 12 months at no cost
Secured the services of Kroll to provide identity monitoring
Enhancing the security of how we handle Form 1099 information
Changes made: Enhancing the security of how we handle Form 1099 information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/FPI-Management.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2017
Raw hash: 548bf2f3349f1b93adbf45952e1a7a0dd59f992475dc388ce4185a55fb5ea139

Reporting entityFPI

Victim entityFPI Management

Incidentdiscovered Jan 31, 2017

Stated responseOffering credit and identity monitoring services for 12 months at no cost

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov