HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)MediumContained

NCB Management Services, Inc.

bd_0da858af768e2afb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 4, 2023

Filed

Mar 29, 2023

To disclose

8 weeks

Affected

2,210state residents only

Linked

18 filings

Confidence

66%

Full breach record for NCB Management Services, Inc. →5 incidents on file

NCB Management Services, Inc. notified the New Hampshire Attorney General of a security incident affecting Bank of America customer data. An unauthorized party accessed NCB systems on February 1, 2023, discovered on February 4, 2023. The incident potentially exposed credit card account details for 2,210 New Hampshire residents. NCB stopped the unauthorized activity, notified law enforcement, and began customer notifications on March 24, 2023, offering two years of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 8 weeks / 53 days

Feb 1, 2023

Begins

Feb 4, 2023

Discovered

Mar 29, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 18 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_153c9cd6421b02832023-05-22 · +54dVerified
Montana State AGbd_46c7daa7a37aa4712023-05-22 · +54dVerified
New Hampshire State AGbd_7e00d3aca7b39e632023-05-22 · +54dVerified
California State AGbd_84b3b575dbace3ec2023-05-22 · +54dVerified

Show 6 more filings ↓up to 91d gap

Maine State AGbd_7d3222e6f53876be2023-05-23 · +55dVerified
New Hampshire State AGbd_34294cfa92e780832023-05-26 · +58dVerified
Montana State AGbd_af43cc04b6170ecc2023-05-26 · +58dVerified
Maine State AGbd_dc77d4029dd3d7c12023-05-26 · +58dVerified
Delaware State AGbd_a59e7f90661deffd2023-06-16 · +79dVerified
New Hampshire State AGbd_ebea091fe68ee6882023-06-28 · +91dVerified

Showing first 10 of 17 linked disclosures.

Name: WILMER CUTLER PICKERING HALE AND DORR LLP
norm: wilmer cutler pickering hale and dorr

Name: NCB Management Services, Inc.
norm: ncb management
Industry: Financial Servicesllm

Discovered: Feb 4, 2023
Breach occurred: Feb 1, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2023
Affected individuals: 2,210state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Notified law enforcement
Obtained assurances that the third party no longer has any of the information on its systems
Notifying impacted Bank of America customers beginning March 24, 2023
Making available a complimentary two-year membership in an identity theft protection service
Changes made: Stopped the unauthorized activity on NCB’s systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 6 states

View merged incident ↗

New Hampshire State AGMar 29 · first · this page

Oregon State AG+54d

Montana State AG+54d

New Hampshire State AG+54d

California State AG+54d

Maine State AG+55d

New Hampshire State AG+58d

Montana State AG+58d

Maine State AG+58d

Delaware State AG+79d

New Hampshire State AG+91d

Pattern: first filing Mar 29 (NH), last Jun 28 (NH) — a 91-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 17 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ncb-management-services-20230329.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2023
Raw hash: f1beb2448b7976f33f1e0cfbe426f4d41ba94c9c30057d711a0d5af0ba691110

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityWILMER CUTLER PICKERING HALE AND DORR LLP

Victim entityNCB Management Services, Inc.

Incidentdiscovered Feb 4, 2023

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov