MalwareEnergy & UtilitiesUtilitiesRansomwareData EncryptedRansom DemandedIdentity (basic)Government IDFinancial accountMediumContained

Eastern Propane & Oil

bd_12e833791a97ead6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 29, 2021

Filed

Sep 20, 2021

To disclose

25 weeks

Affected

642state residents only

Linked

3 filings

Confidence

67%

Full breach record for Eastern Propane & Oil →

Eastern Propane and Oil notified the NH AG of a ransomware incident affecting 642 NH residents. Discovered March 29, 2021, the malware encrypted files and was introduced by an unauthorized actor. Data impacted included names, SSNs, driver's licenses, and financial accounts. Notification sent Sept 15, 2021. FBI notified; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 175 days

Mar 29, 2021

Discovered

Sep 20, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_515b3d83730c34e42021-09-15 · +5dVerified
Maine State AGbd_781ea9f2fb1831a72021-09-15 · +5dCandidate

Name: Eastern Propane & Oil
norm: eastern propane oil

Name: Eastern Propane & Oil
norm: eastern propane oil
Industry: Energy & Utilitiesllm

Discovered: Mar 29, 2021
Materiality determined: —
Notification sent: Sep 15, 2021
Affected individuals: 642state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported this incident to the FBIreporting to other state and federal regulators as required
Initial access: valid_credentials

During the incident: Launched an investigation, with the assistance of leading third-party computer forensic specialists
Undertook a lengthy and labor-intensive process to identify sensitive information
Took steps to notify impacted individuals
Working to implement additional safeguards and training for its employees
Providing access to credit monitoring services for two years through Kroll
Providing contact information for a dedicated call center
Reported this incident to the FBI
Changes made: Implementing additional safeguards and training for its employees
Reviewing our policies, procedures, and processes related to storage of and access to personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(175 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 15 · first

Maine State AGSep 15 · first

New Hampshire State AG+5d · this page

Pattern: first filing Sep 15 (MA), last Sep 20 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/eastern-propane-oil-20210920.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2021
Raw hash: 70dcda7f79e18e189b3438242dd3b71428ec5a40bbbd1e2e7bb54c2f775f1ec4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEastern Propane & Oil

Victim entityEastern Propane & Oil

Incidentdiscovered Mar 29, 2021

Stated responseLaunched an investigation, with the assistance of leading third-party computer forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov