Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

Ursus, Inc.

bd_16435c4852f6ec48 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 25, 2016

Filed

Sep 8, 2016

To disclose

19 weeks

Affected

42state residents only

Linked

4 filings

Confidence

66%

Full breach record for Ursus, Inc. →

Ursus Holdings, LLC notified the NH AG of a phishing incident where an employee's credentials were stolen, leading to unauthorized access to email accounts. Documents containing PII (names, SSNs) and financial data of 42 NH residents were accessed. Ursus isolated accounts, reset passwords, implemented MFA, and planned to offer credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 35 days

discovery → filing · 19 weeks / 136 days

Mar 21, 2016

Begins

Apr 25, 2016

Discovered

Sep 8, 2016

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_9d51c563f8db9ca82016-09-12 · +4dVerified
Montana State AGbd_9d0cf604079ee6db2016-09-15 · +7dCandidate
California State AGbd_99a53da8602d20da2016-09-19 · +11dVerified

Name: Ursus, Inc.
norm: ursus
Domain: ursusinc.com

Name: Ursus, Inc.
norm: ursus
Domain: ursusinc.com
Industry: Professional Servicesllm

Discovered: Apr 25, 2016
Breach occurred: Mar 21, 2016
Undetected for: 35 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 12, 2016
Affected individuals: 42state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Isolated the affected email account
Investigated the incident
Secured other accounts that may have been compromised
Reset the employee email account passwords
Revoked authentication tokens
Implemented two-factor authentication
Changes made: Implemented two-factor authentication
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(136 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGSep 8 · first · this page

Massachusetts State AG+4d

Montana State AG+7d

California State AG+11d

Pattern: first filing Sep 8 (NH), last Sep 19 (CA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ursus-holdings-20160908.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2016
Raw hash: 27da175592faf5ffce74954d7ae45a580b58fc52e97d04069d313019f1c55206

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityUrsus, Inc.

Victim entityUrsus, Inc.

Incidentdiscovered Apr 25, 2016

Stated responseIsolated the affected email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov