HackingTechnologyProfessional ServicesInformationStolen CredentialsBECCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDEmploymentHighContained

Presidio, Inc.

bd_f5bc802981631f55 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 13, 2020

Filed

Apr 25, 2020

To disclose

6 weeks

Affected · nationwide

3,32444 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Presidio, Inc. →

Presidio, Inc. reported a data breach affecting 3,324 current and former employees. An unknown third party gained unauthorized access to a software service on March 5, 2020, altering direct deposit accounts for 13 employees and diverting funds from two. Presidio discovered the breach on March 13, 2020. Affected data included names, SSNs, and compensation info. Presidio contained the incident, engaged forensic investigators, and provided 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 6 weeks / 43 days

Mar 5, 2020

Begins

Mar 13, 2020

Discovered

Apr 25, 2020

Filed

vs. sector median

13 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_85f0737cd6ced6932020-04-21 · +4dVerified
Massachusetts State AGbd_b29e8631320149cc2020-04-21 · +4dVerified

Name: Presidio, Inc.
norm: presidio
Domain: presidio.com
Industry: IT Solutions

Name: Presidio, Inc.
norm: presidio
Domain: presidio.com
Industry: IT Solutions
Industry: TechnologyllmProfessional Servicesllm

Discovered: Mar 13, 2020
Breach occurred: Mar 5, 2020
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 21, 2020
Affected individuals: 3,324state + nationwide
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Internal IT and cybersecurity teams took immediate action to investigate
Corrected all the direct deposit accounts altered by the intruder
Restored in full the funds that had been diverted from two accounts
Contacted the banks to retrieve the misdirected deposits
Conducted a thorough investigation of the intrusion and all records affected by it
Engaged the expert forensic services of an external cybersecurity firm to review the company's own investigation
Provided written notice of the data breach to all affected individuals
Arranged for TransUnion to provide credit monitoring and identity theft restoration services for 12 months
Changes made: Implemented proactive security measures designed to prevent a recurrence of the cyberattack
Evaluating additional enhancements to its written protocols for the protection of the personal information, accounts, and privacy of its employees
Evaluating enhancements to its personal data protection policy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGApr 21 · first

Massachusetts State AGApr 21 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/presidio-20200425.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2020
Raw hash: fb7d5a95830881de94e60b81d85c9052d5274e2381099a499f7768f85c266d59

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPresidio, Inc.

Victim entityPresidio, Inc.

Incidentdiscovered Mar 13, 2020

Stated responseInternal IT and cybersecurity teams took immediate action to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov