HackingEnergy & UtilitiesUtilitiesStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

Penn Power Group, LLC

bd_07a0990bc44d382a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 3, 2023

To disclose

—

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Penn Power Group, LLC →

Penn Power Group notified the NH Attorney General of a data security incident occurring between Jan 26 and Feb 7, 2023. An unauthorized actor accessed files containing New Hampshire residents' personal information. Two residents were notified on April 3, 2023, and offered credit monitoring. PPG secured its network and enhanced security training.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Jan 26, 2023

Begins

Apr 3, 2023

Filed

This filing is one of 4 about the same incident.View merged incident

A leak claim by blackbyte about this victim predates this filing by 55 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblackbytebd_dc50e6afef92534e2023-02-07 · +55dVerified by operator

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_7a3df7d70a18a9002023-04-03Verified
Massachusetts State AGbd_a36f0e222b07b59a2023-04-03Verified

Name: Penn Power Group, LLC
norm: penn power
Domain: pennpowergroup.com

Name: Penn Power Group, LLC
norm: penn power
Domain: pennpowergroup.com
Industry: Energy & Utilitiesllm

Discovered: —
Breach occurred: Jan 26, 2023 – Feb 7, 2023
Materiality determined: —
Notification sent: Apr 3, 2023
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Attorney General John Formella
Initial access: valid_credentials

During the incident: Took measures to help secure its network
Began an investigation
Conducted a thorough review of the files
Established a dedicated, toll-free incident response line
Offering complimentary credit monitoring and identity theft protection services
Mailed notification letters via United States Postal Service First-Class mail
Changes made: Implemented additional measures to enhance the security of its network
Continues to provide data security training to its employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGApr 3 · first

Massachusetts State AGApr 3 · first

New Hampshire State AGApr 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/penn-power-group-20230403.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2023
Raw hash: ef21daa86ac572677290e743e29fbaaf66a31f7bb719bc87babab6da2de0199c

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityPenn Power Group, LLC

Victim entityPenn Power Group, LLC

IncidentUnauthorized Access

Stated responseTook measures to help secure its network

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov