MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

PHH Corporation

bd_f21e69974ef4ceaf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 3, 2013

Filed

May 10, 2013

To disclose

5 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for PHH Corporation →2 incidents on file

PHH Corporation notified individuals that a temporary worker, who had been indicted for identity fraud unrelated to PHH, may have accessed personal information of current and former employees and applicants. The data accessed included names, addresses, email addresses, telephone numbers, dates of birth, Social Security numbers, and I-9 alien registration numbers. PHH initiated a review of the worker's access and is cooperating with law enforcement. No evidence of data misuse was found. PHH offered 18 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 37 days

Apr 3, 2013

Discovered

May 10, 2013

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: PHH Corporation
norm: phh

Name: PHH Corporation
norm: phh
Industry: Financial Servicesllm

Discovered: Apr 3, 2013
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Insider
Threat actor: Partner
Third party: via Temporary workerContractor
Initial access: trusted_relationship

During the incident: Promptly initiated a review of the individual’s access to this information
Cooperating with law enforcement authorities to investigate the issue
Offering identity protection services at no charge through AllClear ID
Changes made: Enhancing some of our policies surrounding temporary employees and access to data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-41751
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2013
Raw hash: 839dc32ad4fa3ea168029a7e1ed9454368605134fb20f79be1dc7718326831cf

Reporting entityPHH Corporation

Victim entityPHH Corporation

Incidentdiscovered Apr 3, 2013

Stated responsePromptly initiated a review of the individual’s access to this information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov