Social EngineeringGovernmentGovernmentPhishingStolen CredentialsTargetedEmployee Data InvolvedIdentity (basic)Financial accountLowResolved

Department of Health and Human Services, State of NH

bd_1002a4a72f30fce8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 5, 2019

Filed

Jun 13, 2019

To disclose

10 weeks

Affected

1state residents only

Confidence

64%

NH DHHS notified the AG of a security breach where a staff member's PII (name, address, bank info) was disclosed via email fraud on March 20-21, 2019. The fraud was detected on April 5, 2019. One employee affected.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 10 weeks / 69 days

Mar 20, 2019

Begins

Apr 5, 2019

Discovered

Jun 13, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Department of Health and Human Services, State of NH
norm: department of health and human services

Name: Department of Health and Human Services, State of NH
norm: department of health and human services
Industry: Governmentllm

Discovered: Apr 5, 2019
Breach occurred: Mar 20, 2019 – Mar 21, 2019
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Gordon MacDonald pursuant to NH RSA 359-C:20
Initial access: phishing_link

During the incident: Notified the affected staff member by phone and in writing
Provided information including the link to the NH AG Consumer Protection Bureau website relating to safeguards for consumers when faced with potential identity theft
Performed a thorough internal investigation
Initiated affirmative steps and updated procedures to prevent a similar situation from arising in the future
Changes made: Updated procedures to prevent a similar situation from arising in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/health-human-services-20190613.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2019
Raw hash: 25aa191c876c31d899fede20d55738392e356e0daed2f3f860ef73a6b99708d2

Reporting entityDepartment of Health and Human Services, State of NH

Victim entityDepartment of Health and Human Services, State of NH

Incidentdiscovered Apr 5, 2019

Stated responseNotified the affected staff member by phone and in writing

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov