MalwareOtherRansomwareRansom DemandedData ExfiltratedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

English Construction Company

bd_1736d001c5775842 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 27, 2024

Filed

Nov 12, 2024

To disclose

7 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for English Construction Company →2 incidents on file

English Construction Company notified the NH Attorney General of a ransomware incident discovered on Sept 27, 2024. Attackers encrypted servers and allegedly exfiltrated employee PII (names, SSNs, etc.). 1 NH resident notified. FBI and CISA engaged. Kroll providing credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d7 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 7 weeks / 46 days

Sep 27, 2024

Begins

Sep 27, 2024

Discovered

Nov 12, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

A leak claim by lynx about this victim predates this filing by 61 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelynxbd_63d75144d88f19a62024-09-12 · +61dVerified by operator

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_d7619c4a090a9c3f2024-11-07 · +5dVerified

Name: English Construction Company
norm: english construction
Domain: englishconst.com

Name: English Construction Company
norm: english construction
Domain: englishconst.com
Industry: Otherllm

Discovered: Sep 27, 2024
Breach occurred: Sep 27, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 7, 2024
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified FBI’s Cyber Crimes DivisionNotified Cybersecurity and Infrastructure Security Agency (CISA)

During the incident: Engaged leading outside cybersecurity experts to investigate and remediate the incident
Notified the FBI’s Cyber Crimes Division
Notified the Cybersecurity and Infrastructure Security Agency (CISA)
Cooperating with law enforcement
Notified all employees employed in the window of 2005 through the present
Provided complimentary credit monitoring through Kroll
Changes made: Secured the services of Kroll to provide identity monitoring
Continuing to evaluate additional actions to strengthen network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGNov 7 · first

New Hampshire State AG+5d · this page

Pattern: first filing Nov 7 (IN), last Nov 12 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/english-construction-20241112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2024
Raw hash: b06fb456e0b63da7a0e836e9377db4a544c6a7554668a2be9875ab7ea27d4952

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityEnglish Construction Company

Victim entityEnglish Construction Company

Incidentdiscovered Sep 27, 2024

Stated responseEngaged leading outside cybersecurity experts to investigate and remediate the incident

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov