HackingManufacturingManufacturingStolen CredentialsEmployee Data InvolvedDelayed DiscoveryGovernment IDPIIMediumContained

Stryker Instruments

bd_e4f161f9ce5cc31f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 18, 2008

Filed

Apr 10, 2008

To disclose

7 weeks

Affected

7state residents only

Linked

2 filings

Confidence

66%

Full breach record for Stryker Instruments →

Stryker Instruments notified NH AG of a breach discovered Feb 18, 2008, where an unauthorized user (suspected former employee) accessed the VPN. The incident involved a database of employee SSNs. 7 NH residents were potentially affected. Notices sent April 10, 2008. Forensic investigators and Kroll Inc. engaged.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 52 days

Feb 18, 2008

Discovered

Apr 10, 2008

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1131940cb4af168e2008-04-11 · +1dVerified

Name: Stryker Instruments
norm: stryker instruments
Domain: stryker.com

Name: Stryker Instruments
norm: stryker instruments
Domain: stryker.com
Industry: Manufacturingllm

Discovered: Feb 18, 2008
Materiality determined: —
Notification sent: Apr 10, 2008
Affected individuals: 7state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: contacted the office of its local U.S. Attorney and the Federal Bureau of Investigationinformal discussions with the FBI about a potential criminal investigation
Initial access: valid_credentials

During the incident: Disabled the domain administrator service account
Engaged an independent computer forensics investigator
Contacted the office of its local U.S. Attorney and the Federal Bureau of Investigation
Engaged Kroll Inc. to provide access to its ID TheftSmart service
Changes made: Discontinued access to the VPN through the domain administrator service accounts
Performed an audit of its privileged access accounts and eliminated any unnecessary service accounts
Changed the passwords of all service accounts
Implemented a policy to prohibit user password changes via telephone
Developing procedures to ensure that access to Stryker’s network will be disabled immediately upon an employee’s termination
Developing a procedure to review service accounts and change passwords
Eliminating potential gaps in its current internal audit system
Requiring two-factor authentication for all remote network access
Disabling one of its existing VPNs and moving all users to a single, more secure VPN
Implementing a system of consolidating and monitoring user log files for potential security breaches
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 10 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/stryker-instruments-20080410.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2008
Raw hash: 745f39014bd0cfb7f33d9de9d8c7086110d29023cec12b821b9ca110aae0db9d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityStryker Instruments

Victim entityStryker Instruments

Incidentdiscovered Feb 18, 2008

Stated responseDisabled the domain administrator service account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov