Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDPIIHighResolved

Safety Net Works Inc.

bd_0534992e6a5313f0 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 28, 2025

Filed

Oct 3, 2025

To disclose

35 weeks

Affected · nationwide

1,8922 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Safety Net Works Inc. →

Safety Net Works Inc. d/b/a MVD Express OS LLC reported a data breach discovered on Jan 28, 2025, where threat actors accessed an employee email account via phishing, exposing client PII including SSNs and driver's licenses. 1,892 individuals affected; 2 in NH. Notifications sent Sept 30, 2025. Incident resolved; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 35 weeks / 248 days

Jan 28, 2025

Discovered

Oct 3, 2025

Filed

vs. sector median

+28 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_04ef4dace09ddd562025-10-03Verified
Maine State AGbd_78341dff347728202025-10-02 · +1dVerified
Indiana State AGbd_3032c11dd02a51382025-09-30 · +3dCandidate

Name: Gerber Ciano Kelly Brady LLP
norm: gerber ciano kelly brady
Domain: gerberciano.com

Name: Safety Net Works Inc.
norm: safety net works
Also named: Safety Net Works Inc.dba oflegal entity
MVD Express OS LLCdba oftrade name
Industry: Retail & Consumerllm

Discovered: Jan 28, 2025
Materiality determined: —
Notification sent: Sep 30, 2025
Affected individuals: 1,892state + nationwide
Data types: Identity (basic)Government IDPII
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection Bureau
Initial access: phishing_link

During the incident: Implemented more robust technology controls
Added a notice to emails coming from official partner companies
Updated employee training
Added branding to login page
Developed custom scripts for verifying access message IDs
Created tenant wide retention policies
Restricted use of emails for transmission of personal information
Use secure transfer protocols for handling personal information
Implemented multifactor authentication
Changing passwords
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Implemented more robust technology controls
Updated employee training
Added branding to login page for easier identification
Developed custom scripts for verifying access message IDs
Created tenant wide retention policies to manage data lifecycle
Restricted use of emails for transmission of personal information
Use secure transfer protocols for handling personal information
Implemented multifactor authentication to better protect account access
Changing passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(248 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 30 · first

Maine State AG+2d

Montana State AG+3d

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/safety-net-works-mvd-os-20251003.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2025
Raw hash: 6308ee4039d85d2424f382c123ff7e36bb61ebfe27a8c12e0aefa6a5e0a76eff

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityGerber Ciano Kelly Brady LLP

Victim entitySafety Net Works Inc.

Incidentdiscovered Jan 28, 2025

Stated responseImplemented more robust technology controls

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov