Social EngineeringPhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICLowContained
SAG-AFTRA Health Plan
bd_1b5088553ded9aac · schema v1 · pii pii-v1
Full breach record for SAG-AFTRA Health Plan →SAG-AFTRA Health Plan submitted a supplemental notice to the New Hampshire Attorney General regarding a cybersecurity incident. An employee's email account was compromised via phishing between September 17-18, 2024. The incident exposed personal information of 112 New Hampshire residents. The Plan contained the incident, engaged third-party experts, notified law enforcement, and offered credit monitoring services.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_0ca33c9d0a197ad5Vermont State AGfiled 2025-03-14Verified
- bd_4a1f1caa590b3465California State AGfiled 2025-03-14Verified
- bd_76baac9c98e3afcdOregon State AGfiled 2025-03-14Candidate
- bd_dfd33c6fd0994f17Washington State AGfiled 2025-03-14Verified by operator
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/sag-aftra-health-plan-20250314.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 14, 2025
- Raw hash
- d7197235649db636995cb3f51c846c347e81ff2b7abdd700d9c3ce7f870fc2f7
Reporting entity
- Name
- SAG-AFTRA Health Plannorm: sag aftra health plan
Victim entity
- Name
- SAG-AFTRA Health Plannorm: sag aftra health plan
Incident
- Discovered
- Sep 18, 2024
- Materiality determined
- Feb 7, 2025
- Notification sent
- Mar 14, 2025
- Affected individuals
- 112
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Submitted supplemental notice to Attorney General John Formella's office
- Initial access
- phishing_link
Compliance
- Time to disclose
- 25 weeks(177 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.