HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Enservio, Inc.

bd_20606b963325a8cc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 10, 2018

Filed

Jan 9, 2019

To disclose

4 weeks

Affected

5state residents only

Linked

2 filings

Confidence

67%

Full breach record for Enservio, Inc. →

Enservio, Inc. notified the NH Attorney General of a potential security incident where an unauthorized individual accessed web-based email accounts containing names, addresses, and SSNs of 5 NH residents. Enservio engaged forensic investigators, reset passwords, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Dec 10, 2018

Discovered

Jan 9, 2019

Filed

vs. sector median

14 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_b3c75690a78ee3422019-01-08 · +1dVerified

Name: Enservio, Inc.
norm: enservio

Name: Enservio, Inc.
norm: enservio
Industry: Professional Servicesllm

Discovered: Dec 10, 2018
Materiality determined: —
Notification sent: Jan 9, 2019
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged an outside forensic firm to assist in investigating and remediating the situation
Resetting all affected e-mail accounts' passwords
Providing additional training to its employees on the maintenance of personal information and how to recognize e-mail phishing schemes
Changes made: Providing additional training to its employees on the maintenance of personal information and how to recognize e-mail phishing schemes
Offering twelve months of identity protection services that includes credit monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 8 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/enservio-20190109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 9, 2019
Raw hash: 83f480c954eb539383850addcf21eee8e202742ab6e55ec236db558d60b1cda2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEnservio, Inc.

Victim entityEnservio, Inc.

Incidentdiscovered Dec 10, 2018

Stated responseEngaged an outside forensic firm to assist in investigating and remediating the situation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov