Canon Business Process Services

Summary

A cybersecurity incident involving a service provider for General Equipment (GE) resulted in unauthorized access to an email account containing sensitive personal information of current and former employees and beneficiaries. The breach exposed documents such as direct deposit forms, identification records, tax documents, and benefit applications, compromising names, Social Security numbers, bank account details, passport numbers, and other personally identifiable data. GE confirmed its own systems were not compromised, and the affected provider, Canon Business Process Services, offered impacted individuals complimentary identity protection and credit monitoring services for two years. GE established a dedicated support line to assist those affected by the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The incident involving Canon Business Process Services began on or around February 3, 2020, when an unauthorized party gained access to an employee email account maintained by Canon. This breach persisted until approximately February 14, 2020, exposing documents containing sensitive personal information of General Electric (GE) employees, former employees, and beneficiaries. Canon, a service provider for GE, discovered the intrusion and notified GE of the security incident on February 28, 2020. The compromised email account contained workflow routing service documents that had been uploaded by or for GE-affiliated individuals, including direct deposit forms, identification documents, tax records, and benefits applications. Specific exposed data elements included full names, addresses, Social Security numbers, driver's license numbers, passport numbers, bank account details, dates of birth, and information contained in marriage certificates, death certificates, medical support orders, and benefits documentation.

GE confirmed its internal systems were not compromised during the breach, as the incident was isolated to Canon's infrastructure. In response, GE issued formal breach notifications through the Office of the California Attorney General and established a dedicated support hotline operating during Eastern Time business hours. Canon arranged two years of complimentary identity protection and credit monitoring services through Experian for affected individuals, with an enrollment deadline of June 30, 2020. GE publicly characterized the protection of personal information as a top priority but declined to disclose the exact number of impacted individuals when queried by media. The company stated it was implementing measures to prevent recurrence of similar incidents through its service providers, though no technical details about containment procedures or forensic findings were disclosed in available documentation.

Sources

Sources available to members: 1 source.