AccidentalProfessional ServicesProfessional ServicesMisdeliveryEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumResolved

Delta Air Lines, Inc.

bd_e7d71945a4b1eef1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 18, 2018

Filed

Jul 18, 2018

To disclose

4 weeks

Affected

700

Confidence

66%

Full breach record for Delta Air Lines, Inc. →6 incidents on file

Delta Global Services inadvertently emailed a spreadsheet containing personal information of approximately 700 employees to a small group of 45 current or former employees who did not normally have access. The data included names, addresses, phone numbers, emails, dates of birth, Social Security numbers, and employment application details. The incident occurred on June 18, 2018, and was discovered the same day. Recipients were instructed to delete the file. Approximately 2 New Hampshire residents were affected. The company offered 12 months of identity theft protection and provided additional security training.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Jun 18, 2018

Begins

Jun 18, 2018

Discovered

Jul 18, 2018

Filed

vs. sector median

10 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed700 affectedView incident

Name: Delta Air Lines, Inc.
norm: delta air lines
Domain: ir.delta.com

Name: Delta Air Lines, Inc.
norm: delta air lines
Domain: ir.delta.com
Industry: Professional Servicesllm

Discovered: Jun 18, 2018
Breach occurred: Jun 18, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 27, 2018
Affected individuals: 700state + nationwide
Data types: Identity (basic)Government IDEmployment
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified the Attorney General of New Hampshire

During the incident: Advised the recipients of the confidential nature of the contents of the file
Instructed the recipients to refrain from accessing, printing or using any of the information contained in the file
Instructed the recipients to permanently delete the file, including from their 'deleted items' folder
Established a call center to answer employees' questions
Changes made: Providing additional training on the handling of DGS confidential information
Offering the affected employees 12 months of identity theft protection services from AllClearID at no cost to the employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/delta-global-20180718.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2018
Raw hash: 2d6362eb3fff45d1eb7f8f23e93f903311eef51526fe49c5e9e1aa0be775d970

Reporting entityDelta Air Lines, Inc.

Victim entityDelta Air Lines, Inc.

Incidentdiscovered Jun 18, 2018

Stated responseAdvised the recipients of the confidential nature of the contents of the file

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov