HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountFinancial credentialsMediumContained

ARC HOME LLC

bd_1a217f9fabd50c19 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 27, 2020

Filed

Dec 1, 2020

To disclose

14 weeks

Affected

17state residents only

Linked

4 filings

Confidence

66%

Full breach record for ARC HOME LLC →2 incidents on file

Arc Home LLC, a residential lender and servicer, notified the New Hampshire Attorney General of a security incident affecting 17 state residents. Between August 26-27, 2020, an unauthorized party accessed a single employee email account. The breach exposed SSNs, driver's license numbers, financial account numbers, and payment card numbers. Arc secured the account, hired forensic investigators, and mailed notices to affected individuals on November 25, 2020, offering one year of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 14 weeks / 96 days

Aug 26, 2020

Begins

Aug 27, 2020

Discovered

Dec 1, 2020

Filed

vs. sector median

+4 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_966fab7478aa862c2020-11-30 · +1dVerified
Maine State AGbd_a0a75f7bb94e92462020-11-30 · +1dCandidate
Indiana State AGbd_b5798213ef7cea502020-11-25 · +6dVerified

Name: ARC HOME LLC
norm: arc home

Name: ARC HOME LLC
norm: arc home
Industry: Financial Servicesllm

Discovered: Aug 27, 2020
Breach occurred: Aug 26, 2020 – Aug 27, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 25, 2020
Affected individuals: 17state-resident count only
Data types: Government IDIdentity (basic)Financial accountFinancial credentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the account
Began an investigation
A cybersecurity forensic firm was hired to assist
Arc Home completed a careful review of the email account
Arc provided written notice to the New Hampshire residents by mailing letters via United States Postal Service First-Class mail
Arc is offering the New Hampshire residents a complimentary, one-year membership to credit monitoring and identity theft prevention services through Kroll
Changes made: Taking steps to enhance its existing security protocols
Re-educating our staff for awareness on these types of incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGNov 25 · first

Massachusetts State AG+5d

Maine State AG+5d

New Hampshire State AG+6d · this page

Pattern: first filing Nov 25 (IN), last Dec 1 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/arc-home-20201201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2020
Raw hash: 120a734492abfe5d336caca2efd8964ba6ce9a87b1b1e1cf67300ec6c7d4afce

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityARC HOME LLC

Victim entityARC HOME LLC

Incidentdiscovered Aug 27, 2020

Stated responseSecured the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov