Social EngineeringHealthcareHealthcarePhishingBECEmployee Data InvolvedData ExfiltratedGovernment IDIdentity (basic)Financial accountEmploymentMediumContained

KeraLink International

bd_fb62060160e9054f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2017

Filed

Apr 25, 2017

To disclose

19 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for KeraLink International →

KeraLink International experienced a business email compromise (BEC) incident on April 6, 2017, where a human resources assistant responded to a spoofed email requesting 2016 W-2 forms for current and former employees. The attacker impersonated the CEO. W-2 forms containing names, addresses, Social Security numbers, and wage information were sent to the attacker. One New Hampshire resident was affected. The company notified the FBI and IRS, launched an investigation, and provided credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 days

Apr 6, 2017

Begins

Apr 6, 2017

Discovered

Apr 25, 2017

Filed

vs. sector median

10 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_d12a48384a4325462017-04-25Verified

Name: KeraLink International
norm: keralink international

Name: KeraLink International
norm: keralink international
Industry: Healthcarellm

Discovered: Apr 6, 2017
Breach occurred: Apr 6, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 7, 2017
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial accountEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified the IRSNotified the FBIProviding written notice of this incident to other state regulators as necessary
Initial access: phishing_link

During the incident: Launched an investigation
Provided preliminary notice by way of email and posting on internal communication system
Mailed notice letters to individuals
Providing all potentially affected individuals access to 1 free years of credit and identity monitoring services through ID Experts
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Notified the IRS and FBI
Providing written notice of this incident to other state regulators as necessary
Changes made: Internally reviewing employee training curriculum with regard to phishing scams
Working to implement additional safeguards
Providing additional mandatory training to our employees on safeguarding the privacy and security of information on our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 25 · first

New Hampshire State AGApr 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/keralink-20170425.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2017
Raw hash: 978f7896b81e730fac7dee007f552fe8331b7a1e03ebbe8bb861aeee2d334e9e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKeraLink International

Victim entityKeraLink International

Incidentdiscovered Apr 6, 2017

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov