P2018-ND-105

The Organization engaged an online survey service provider based in Barcelona, Spain, Typeform, to distribute surveys to clients and prospects. Typeform gathered survey responses and provided them to the Organization for integration into the Organization?s own systems. Typeform maintained copies of survey responses on its cloud-based servers. On June 29, 2018, Typeform advised the Organization that an unknown third party gained access to its back-up systems and downloaded certain information collected from the Organization?s clients and prospects, from surveys provided by Typeform, on behalf of the Organization. Typeform advised the Organization that the incident was identified on June 27, 2018 at 2 PM CET, and that by 2:30 PM CET, actions had been taken to remedy the cause of the incident that enabled the unknown third party to gain access to Typeform?s systems.