HackingOtherStolen CredentialsCustomer Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumContained

People for People

bd_eda52ece9d66a5d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 20, 2016

Filed

Mar 17, 2017

To disclose

21 weeks

Affected

821state residents only

Linked

2 filings

Confidence

70%

Full breach record for People for People →

People for People, a nonprofit in Yakima, WA, reported a cyberattack on Oct 20, 2016, where an unauthorized individual accessed an employee email account. 821 WA residents' PII (names, SSNs, DLs, DOBs, bank info, medical data) was compromised. PFP secured the account, engaged forensic investigators, and offered 12 months of credit monitoring. Notice sent March 16, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 148 days

Oct 20, 2016

Begins

Oct 20, 2016

Discovered

Feb 3, 2017

Scope determined

Mar 17, 2017

Filed

vs. sector median

+13 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_59ddd2a40aea3b4e2017-03-20 · +3dVerified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: People for People
norm: people for people
Industry: Otherllm

Discovered: Oct 20, 2016
Breach occurred: Oct 20, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: Feb 3, 2017
Notification sent: Mar 16, 2017
Affected individuals: 821state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Medical informationDate of birthFinancial account numberDriver's licence numberSocial Security numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Washington State Attorney General
Initial access: valid_credentials

During the incident: Secured the email account
Changed passwords for other employee accounts
Initiated an investigation
Engaged a digital forensics firm to determine the scope of the problem
Notified the affected individuals via attached letters
Offered 12 months of credit and identity monitoring services through ID Experts
Changes made: Enhancing the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(148 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGMar 17 · first · this page

Montana State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9688.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2017
Raw hash: dfb2c96323971c20d58f2395e85f5a40167e9d3402e0445d37b6e5613b1026eb

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityPeople for People

Incidentdiscovered Oct 20, 2016

Stated responseSecured the email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com