HackingStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
SIRVA, INC.
bd_fcf5060bdd75ba86 · schema v1 · pii pii-v1
Full breach record for SIRVA, INC. →Amgen Inc. reported a supplemental data security incident involving its third-party service provider, Sirva, Inc. Sirva systems were accessed by unknown actors between August 16 and October 17, 2023, resulting in the copying of files containing personal information of Amgen employees and clients. Sirva detected suspicious activity on September 29, 2023. The incident affects 3 New Hampshire residents. Amgen engaged forensic review, notified law enforcement, and provided identity monitoring services via Kroll to affected individuals.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/amgen-sirva-20240925.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 25, 2024
- Raw hash
- e68d8f3cb361689f58b0b50c32252a32a440ae0c39653fe3c2aaf7c34aa515c0
Reporting entity
- Name
- AMGEN INC.norm: amgen
Victim entity
- Name
- SIRVA, INC.norm: sirva
Incident
- Discovered
- Sep 29, 2023
- Materiality determined
- —
- Notification sent
- Sep 25, 2024
- Affected individuals
- 3
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified state Attorneys GeneralNotified global data protection authorities
- Third party
- via Sirva, Inc.
- Initial access
- external_remote_services
Compliance
- Time to disclose
- 52 weeks(362 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.