INTERNATIONAL PAPER COMPANY

International Paper reported a data breach to the Oregon Attorney General. The breach was reported on 2023-12-04. The breach occurred during 5/30/2023 - 7/28/2023. The breach was discovered on 5/31/2023. Notice was sent on 11/22/2023.

International Paper Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-11-29. 34 Massachusetts residents were affected. The report records the breach type as electronic.

Welltok, Inc. notified the International Paper Company Group Health and Welfare Plan of a security event involving the MOVEit Transfer tool. An unauthorized actor exploited a vulnerability in the tool on May 30, 2023, to access the server and exfiltrate personal information, including PHI. Welltok patched the vulnerability and is offering 24 months of credit monitoring to affected individuals. Notice was filed with the South Carolina Department of Consumer Affairs on November 22, 2023.

International Paper Company notified the California AG of a data breach affecting its Group Health and Welfare Plan participants. The incident occurred on May 30, 2023, when an unauthorized actor exploited a vulnerability in Progress Software's MOVEit Transfer tool used by third-party vendor Welltok, Inc. Welltok discovered the potential impact on July 26, 2023, and confirmed data exfiltration. Affected data includes personal information and electronic protected health information (ePHI). Welltok is offering 24 months of credit monitoring via Experian.

Welltok, Inc. reported a security event affecting the International Paper Company Group Health and Welfare Plan. An unknown actor exploited a vulnerability in the MOVEit Transfer tool (managed by Welltok) on May 30, 2023, to exfiltrate personal and health information. Welltok detected the compromise on July 26, 2023. 1,057 Washington residents were notified. Welltok provided 24 months of credit monitoring.

International Paper Company Group Health and Welfare Plan (TN, Health Plan) reported to HHS on 2023-11-14 a Hacking/IT Incident affecting 78,692 individuals. A software application used by its business associate (BA) exposed PHI stored on a network server. PHI involved included names, addresses, dates of birth, Social Security numbers, and health insurance information. The CE notified HHS, affected individuals, and the media. The BA provided credit monitoring services and implemented additional safeguards.