HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedPIIIdentity (basic)LowContained

ChangeLab Solutions

bd_1b1499c4e3190dfb · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 20, 2023

Filed

May 10, 2024

To disclose

25 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for ChangeLab Solutions →

ChangeLab Solutions notified the NH Attorney General of a data security incident discovered on Nov 20, 2023. Unauthorized access to network files may have exposed personal information of one NH resident. ChangeLab engaged cybersecurity experts, secured the network, and offered Experian identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 172 days

Nov 20, 2023

Discovered

May 2, 2024

Scope determined

May 10, 2024

Filed

vs. sector median

+7 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_6afc501107e919df2024-05-10Candidate
Massachusetts State AGbd_6b4633108401f6232024-05-10Verified

Name: ChangeLab Solutions
norm: changelab solutions

Name: ChangeLab Solutions
norm: changelab solutions
Industry: Professional Servicesllm

Discovered: Nov 20, 2023
Materiality determined: May 2, 2024
Notification sent: May 10, 2024
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Attorney General John Formella

During the incident: Engaged cybersecurity experts to conduct an investigation
Took steps to secure the network
Conducted a thorough review of the impacted data
Offering individuals complimentary identity protection services through Experian
Established a toll-free call center through Experian
Changes made: Implemented measures to enhance network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(172 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMay 10 · first

Massachusetts State AGMay 10 · first

New Hampshire State AGMay 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/changelab-solutions-20240510.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2024
Raw hash: a19f819220402b4c4f83fcf2b87aeb874f08d957ba1690f7205bfa560e84582a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityChangeLab Solutions

Victim entityChangeLab Solutions

Incidentdiscovered Nov 20, 2023

Stated responseEngaged cybersecurity experts to conduct an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov