PhysicalProfessional ServicesTechnologyProfessional ServicesTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentHighContained

Bertelsmann, Inc.

bd_f42f476380b6da09 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 1, 2006

Filed

Feb 3, 2007

To disclose

9 weeks

Affected · nationwide

15,0007 in this filing

Confidence

67%

Towers Perrin reported the theft of unencrypted laptops containing PII (names, SSNs, DOB, addresses) of Bertelsmann employees and former employees. Discovered Dec 1, 2006. 15,000 individuals affected nationwide, including 7 NH residents. Notifications began Jan 31, 2007. Remediation included accelerating laptop encryption and engaging a security consultant.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 64 days

Dec 1, 2006

Discovered

Feb 3, 2007

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed15,000 affectedView incident

Name: Towers Perrin
norm: towers perrin
Domain: towersperrin.com

Name: Bertelsmann, Inc.
norm: bertelsmann
Industry: Professional ServicesllmTechnologyllm

Discovered: Dec 1, 2006
Materiality determined: —
Notification sent: Jan 31, 2007
Affected individuals: 15,000state + nationwide
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Legal Notice of Information Security Breach filed with New Hampshire Attorney General

During the incident: Reported the theft to the New York City Police Department (Mid-town South Precinct)
Notified Bertelsmann on January 4, 2007
Notifying the three major national consumer reporting agencies (Equifax, Experian and TransUnion)
Notifying all affected individuals via written letter to each affected individual through first class mail
Offering Equifax’s credit monitoring service free of charge for two years
Changes made: Accelerated a project to encrypt all laptops by the end of January 2007
Engaged an information security consulting firm to review policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/berteslmann-20080203.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2007
Raw hash: 8c604403052beaef4e6f3c1f150321700a5ac12625f8dceeaeafe90a341e9da0

Reporting entityTowers Perrin

Victim entityBertelsmann, Inc.

Incidentdiscovered Dec 1, 2006

Stated responseReported the theft to the New York City Police Department (Mid-town South Precinct)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov