MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Government IDFinancial accountMediumActive

Wm. T. Burnett & Co, and STX, LLC

bd_13037909381f0a1c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 6, 2022

Filed

Nov 4, 2022

To disclose

29 days

Affected

1state residents only

Confidence

66%

Full breach record for Wm. T. Burnett & Co, and STX, LLC →

Wm. T. Burnett & Co. and STX, LLC reported a ransomware incident on September 30, 2022, affecting one New Hampshire resident. Personal information including name, SSN, and financial account data was accessed. The company engaged forensic investigators, contained the threat, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 29 days

Sep 30, 2022

Begins

Oct 6, 2022

Discovered

Nov 4, 2022

Filed

vs. sector median

15 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Wm. T. Burnett & Co, and STX, LLC
norm: wm t burnett co and stx

Name: Wm. T. Burnett & Co, and STX, LLC
norm: wm t burnett co and stx
Industry: Professional Servicesllm

Discovered: Oct 6, 2022
Breach occurred: Sep 30, 2022
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 26, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Engaged external cybersecurity professionals
Conducted forensic investigation
Disabled all unauthorized access to the network
Offered complimentary one-year membership with a credit monitoring service
Provided written notification to the affected resident
Changes made: Strengthened network
Implemented additional security improvements recommended by third-party cyber security experts
Reset account passwords
Strengthened password security policies
Ensured compliance with multi-factor authentication for network access
Upgraded firewall
Deployed endpoint detection software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wm-t-burnett-stx-20221104.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 4, 2022
Raw hash: 16aae42286099acdd0de41b055f1d2e899c60600a571625d38ce613b54912b2a

Reporting entityWm. T. Burnett & Co, and STX, LLC

Victim entityWm. T. Burnett & Co, and STX, LLC

Incidentdiscovered Oct 6, 2022

Stated responseEngaged external cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov