PhysicalTechnologyInformationTheftSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Netegrity, Inc.

bd_e383618ca638bbd1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 27, 2008

Filed

Jul 16, 2008

To disclose

7 weeks

Affected

973

Confidence

66%

Full breach record for Netegrity, Inc. →

CA, Inc. notified the NH AG of a security breach involving former Netegrity, Inc. employees. On May 26, 2008, a server containing PII (names, SSNs, DOBs) of 973 individuals was stolen from third-party vendor Colt Express Outsourcing Services during a break-in. CA notified 42 NH residents and provided 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 50 days

May 26, 2008

Begins

May 27, 2008

Discovered

Jul 16, 2008

Filed

vs. sector median

5 wks faster

Part of Colt Express Outsourcing Services, Inc. supply-chain incident (2008) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed973 affectedView incident

Name: CA, Inc.
norm: ca
Domain: ca.com

Name: Netegrity, Inc.
norm: netegrity
Industry: Technologyllm

Discovered: May 27, 2008
Breach occurred: May 26, 2008 – May 26, 2008
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 21, 2008
Affected individuals: 973state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Notified the Walnut Creek Police Department
Sent notices via first-class mail on or about July 21, 2008
Procured one year of Equifax's Credit Watch Gold Monitoring Services on behalf of affected individuals
Changes made: Implemented formal policies, procedures and required employee training surrounding privacy and data protection
Implementation of a formal vendor questionnaire submitted to vendors before engaging with them
Requirement that vendors sign a Data Protection Agreement including requirements for data encryption and restrictions on data transfers
Internal process for ensuring that any sensitive data transferred to and from vendors is either encrypted or sent through secure means
Implementing processes to audit vendors on a periodic basis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ca-20080716.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2008
Raw hash: d4d929f187c49d08baade397365bacdfcea0eb3b7131330a45c769ca5e6ff355

Reporting entityCA, Inc.

Victim entityNetegrity, Inc.

Incidentdiscovered May 27, 2008

Stated responseNotified the Walnut Creek Police Department

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov