Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedData ExfiltratedGovernment IDIdentity (basic)MediumContained

LEAF Commercial Capital, Inc.

bd_1a6fd2b24a624fc4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 23, 2021

Filed

Nov 29, 2021

To disclose

5 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for LEAF Commercial Capital, Inc. →2 incidents on file

LEAF Commercial Capital, a subsidiary of People's United Bank, notified the New Hampshire Attorney General of a phishing incident affecting two NH residents. An employee clicked a phishing link on Oct 22, 2021, granting an external actor access to their email. The breach was detected on Oct 23, 2021, when suspicious login activity from Zambia triggered an alert. LEAF disabled the account and reset credentials. The incident involved Social Security Numbers and personal data of two NH residents. Affected individuals were notified and provided two years of credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 5 weeks / 37 days

Oct 22, 2021

Begins

Oct 23, 2021

Discovered

Nov 29, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_3f1f316b07d3619c2021-11-26 · +3dVerified

Name: LEAF Commercial Capital, Inc.
norm: leaf commercial

Name: LEAF Commercial Capital, Inc.
norm: leaf commercial
Industry: Financial Servicesllm

Discovered: Oct 23, 2021
Breach occurred: Oct 22, 2021 – Oct 22, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 23, 2021
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Disabled the compromised account
Changed the password
Sent an all-employee communication reminding employees not to provide a MFA code when not expecting it
Assigned mandatory phishing supplemental training to the employee involved
Strengthened the MFA security tool to restrict use to methods more difficult to socially engineer
Reviewed authentication mechanisms tied to external email access and put additional restrictions in place to limit external authentication without MFA or from untrusted sources
Changes made: Provided two years of credit monitoring through myTrueIdentity (TransUnion) to affected residents
Continued employee training and controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 26 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/leaf-commercial-capital-20211129.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 29, 2021
Raw hash: fe618c7a8e87629a6397206557409231270a19ff49b743365d88737a6918d005

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLEAF Commercial Capital, Inc.

Victim entityLEAF Commercial Capital, Inc.

Incidentdiscovered Oct 23, 2021

Stated responseDisabled the compromised account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov