HackingRetail & ConsumerRetailStolen CredentialsPhishingSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDMediumContained

TAUCK, INC.

bd_eed1505b7eac612f · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 4, 2018

Filed

Sep 27, 2018

To disclose

21 weeks

Affected

1state residents only

Confidence

66%

Full breach record for TAUCK, INC. →

Tauck, Inc. notified the NH Attorney General of a data security matter at third-party provider Progressive Benefit Solutions LLC (PBS). PBS confirmed unauthorized access to employee email accounts starting Jan 15, 2018, resulting in the sending of encrypted emails containing PII (SSN, DOB, name) of Tauck/Compass employees. One NH resident was impacted. Tauck provided 36 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 109 days

discovery → filing · 21 weeks / 146 days

Jan 15, 2018

Begins

May 4, 2018

Discovered

Sep 27, 2018

Filed

vs. sector median

+13 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: TAUCK, INC.
norm: tauck

Name: TAUCK, INC.
norm: tauck
Industry: Retail & Consumerllm

Discovered: May 4, 2018
Breach occurred: Jan 15, 2018 – Feb 1, 2018
Undetected for: 109 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 13, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Third party: via Progressive Benefit Solutions LLC
Initial access: valid_credentials

During the incident: Arranged to provide thirty-six (36) months of triple bureau credit monitoring services to all impacted individuals at no charge
Provided identity repair services at no charge
Changed the credentials for the accounts within hours
Deactivated the link to access the encrypted February Email
Instructed all recipients of the February Email to securely delete the email and attachments
Retained a third-party forensic firm to assist in that work
Changes made: Enhanced its security protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(146 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tauck-20180927.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2018
Raw hash: 5e5c8acc7d5aa97528ac7c0a46e59efb4fcea93a6b00657696d69e021ebd7ac8

Reporting entityTAUCK, INC.

Victim entityTAUCK, INC.

Incidentdiscovered May 4, 2018

Stated responseArranged to provide thirty-six (36) months of triple bureau credit monitoring services to all impacted individuals at no charge

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov