AccidentalTransportation & LogisticsTransportationMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Port City Air

bd_1cf9a08a54f41c2d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2024

Filed

Mar 1, 2024

To disclose

16 days

Affected

109state residents only

Linked

3 filings

Confidence

66%

Full breach record for Port City Air →

Port City Air, Inc. notified the NH AG of an accidental email transmission of employee payroll data (names, SSNs, pay info) to internal staff and a UKG vendor employee on Feb 14, 2024. 109 NH residents affected. Notices sent Feb 22, 2024. Remediation includes vendor coordination and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 days

Feb 14, 2024

Begins

Feb 14, 2024

Discovered

Mar 1, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_8427785213da45662024-03-14 · +13dVerified
Massachusetts State AGbd_f86c7a5532d924832024-03-14 · +13dVerified

Name: Port City Air
norm: port city air
Domain: portcityair.com

Name: Port City Air
norm: port city air
Domain: portcityair.com
Industry: Transportation & Logisticsllm

Discovered: Feb 14, 2024
Breach occurred: Feb 14, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 22, 2024
Affected individuals: 109state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau

During the incident: Began an investigation to understand how the incident occurred
In direct contact with payroll software vendor UKG
Notified all current employees by a combination of e-mail and manager outreach
Gave instructions to permanently delete the e-mail from all accounts and devices
Recommended to all affected persons that they change their personal e-mail passwords and enable two-factor authentication
Providing everyone affected, plus unaffected current employees, with a three-year complimentary subscription to Norton LifeLock
Changes made: Reviewing policies and procedures on how to store and transmit sensitive information
Finding a software-based solution to prevent this type of disclosure
Removing any personal e-mail addresses from the payroll systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 1 · first · this page

Maine State AG+13d

Massachusetts State AG+13d

Pattern: first filing Mar 1 (NH), last Mar 14 (MA) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/port-city-air-20240301.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 1, 2024
Raw hash: ab8987ba08ad75fae2b684cccc7baf5d8909d0216713e16d025cbccec5559d04

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPort City Air

Victim entityPort City Air

Incidentdiscovered Feb 14, 2024

Stated responseBegan an investigation to understand how the incident occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov