PhysicalManufacturingManufacturingTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumActive

MULTI-COLOR CORPORATION

bd_fd77e74edaaac53f · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 16, 2016

Filed

Jun 15, 2016

To disclose

4 weeks

Affected

4state residents only

Linked

3 filings

Confidence

66%

Full breach record for MULTI-COLOR CORPORATION →2 incidents on file

Multi-Color Corporation notified the NH Attorney General of a breach affecting 4 NH residents. A third-party law firm's office was burglarized on May 14-15, 2016, stealing a hard drive containing employee PII (names, SSNs, addresses). Multi-Color was notified on May 16, 2016. Notices were sent on June 15, 2016, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 4 weeks / 30 days

May 14, 2016

Begins

May 16, 2016

Discovered

Jun 15, 2016

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_bfd248fcb9d463832016-06-16 · +1dCandidate
California State AGbd_d7942cc9cc20a6532016-08-05 · +51dVerified

Name: MULTI-COLOR CORPORATION
norm: multi color

Name: MULTI-COLOR CORPORATION
norm: multi color
Industry: Manufacturingllm

Discovered: May 16, 2016
Breach occurred: May 14, 2016 – May 15, 2016
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2016
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Joseph Foster pursuant to N.H. Rev. Stat. § 359-C:20
Third party: via East Coast law firm

During the incident: Coordinating an investigation with the law firm, the Baltimore police, private investigators, and other authorities
Arranged to have Experian provide identity protection monitoring services for the next 12 months at no cost to residents
Established a 1-800 number specifically for this incident
Hired a firm to monitor possible internet activity with our data
Changes made: Providing notice to affected residents
Offering free credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

New Hampshire State AGJun 15 · first · this page

California State AG+1d

California State AG+51d

Pattern: first filing Jun 15 (NH), last Aug 5 (CA) — a 51-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/multi-color-20160615.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2016
Raw hash: ce816b09382636b586c882b5a0c34833681b66339cb48671ca70b0e60d98b059

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMULTI-COLOR CORPORATION

Victim entityMULTI-COLOR CORPORATION

Incidentdiscovered May 16, 2016

Stated responseCoordinating an investigation with the law firm, the Baltimore police, private investigators, and other authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov