HackingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Missions Door

bd_0b176f33d5abbcc7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 17, 2017

Filed

Nov 3, 2017

To disclose

16 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for Missions Door →

Missions Door detected suspicious emails sent from an employee's account on July 17, 2017. An unauthorized third party accessed the account. The compromised data included one New Hampshire resident's full name and Social Security number. Missions Door changed the password, retained a forensic firm, and notified the resident and the NH Attorney General on November 3, 2017. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 109 days

Jul 17, 2017

Discovered

Nov 3, 2017

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_61e32b7b89985e612017-11-08 · +5dVerified

Name: Missions Door
norm: missions door
Domain: californiamissionsfoundation.org

Name: Missions Door
norm: missions door

Discovered: Jul 17, 2017
Materiality determined: —
Notification sent: Nov 3, 2017
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Changed the password to the affected email account
Maintained heightened monitoring of the account
Commenced an investigation of the incident
Retained an independent computer forensic firm to analyze the extent of any compromise
Changes made: Strengthen access controls and protocols to help prevent similar issues in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(109 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGNov 3 · first · this page

Massachusetts State AG+5d

Pattern: first filing Nov 3 (NH), last Nov 8 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/missions-door-20171103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2017
Raw hash: daf750c226356c7da4b0fb4a0e97a4230f6a1227bc8b9a17f730c81c931ec7b8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMissions Door

Victim entityMissions Door

Incidentdiscovered Jul 17, 2017

Stated responseChanged the password to the affected email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov