PhysicalRetail & ConsumerRetailTheftEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

KRAFT FOODS GROUP, INC.

bd_f085fe5dce414d32 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 28, 2008

To disclose

—

Affected

15state residents only

Linked

2 filings

Confidence

66%

Full breach record for KRAFT FOODS GROUP, INC. →4 incidents on file

Kraft Foods reported the theft of an employee's laptop in mid-January 2008 while traveling on company business. The unencrypted hard drive contained names and Social Security numbers of approximately 15 employees, including 15 residents of New Hampshire. Kraft notified the NH Attorney General on February 28, 2008, and sent notices to affected individuals on February 26, 2008, offering two years of free credit monitoring. Remediation steps included encrypting laptops, moving data to servers, and conducting security training.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 15, 2008

Begins

Feb 28, 2008

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_80343a0930273d4e2008-03-05 · +6dVerified

Name: KRAFT FOODS GROUP, INC.
norm: kraft foods

Name: KRAFT FOODS GROUP, INC.
norm: kraft foods
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jan 15, 2008 – Jan 31, 2008
Materiality determined: —
Notification sent: Feb 26, 2008
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Attorney General

During the incident: Working with law enforcement authorities to find the laptop
Offering two years of free credit monitoring from TransUnion
Changes made: Eliminating the use and storage of personally identifiable information on laptop computers unless it has been approved and encrypted
Maintaining personally identifiable information on servers rather than laptops
Conducting training for those who have access to personally identifiable information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGFeb 28 · first · this page

Massachusetts State AG+6d

Pattern: first filing Feb 28 (NH), last Mar 5 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kraft-foods-20080228.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 28, 2008
Raw hash: c165ea25c53dc5e15d66880a2f77bc4d704b705c36358d39bdb99080663c4bae

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKRAFT FOODS GROUP, INC.

Victim entityKRAFT FOODS GROUP, INC.

IncidentUnknown

Stated responseWorking with law enforcement authorities to find the laptop

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov