MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedData EncryptedGovernment IDIdentity (basic)PHIMediumContained

STAR GROUP, LTD.

bd_230337d0f70cb052 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 24, 2021

Filed

Jan 25, 2022

To disclose

22 weeks

Affected

78state residents only

Confidence

66%

Full breach record for STAR GROUP, LTD. →2 incidents on file

Star Group, L.P. filed a supplemental notice with the New Hampshire Attorney General regarding a ransomware incident affecting its self-insured health plan. Unauthorized access occurred July 15-17, 2021, resulting in system encryption and exfiltration of names and Social Security numbers for 78 NH residents. Star engaged law enforcement and forensic investigators, offered credit monitoring, and enhanced network security protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 40 days

discovery → filing · 22 weeks / 154 days

Jul 15, 2021

Begins

Aug 24, 2021

Discovered

Jan 25, 2022

Filed

vs. sector median

+12 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed78 affectedView incident

Name: STAR GROUP, LTD.
norm: star group

Name: STAR GROUP, LTD.
norm: star group
Industry: Retail & Consumerllm

Discovered: Aug 24, 2021
Breach occurred: Jul 15, 2021 – Jul 17, 2021
Undetected for: 40 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 26, 2022
Affected individuals: 78state-resident count only
Data types: Government IDIdentity (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: valid_credentials

During the incident: Contacted law enforcement
Began an investigation with the assistance of an outside cybersecurity firm
Restored operations
Offered complimentary one-year memberships to credit monitoring and identity theft protection services through Experian
Established a dedicated call center
Changes made: Enhanced existing network security protocols
Enabled technical protections and monitoring tools on its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(154 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/star-group-20220126.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 25, 2022
Raw hash: 2ef6c61e10fe3fb81e1303256e160f57a3dad30dc883fb88007495cf79a2f705

Reporting entitySTAR GROUP, LTD.

Victim entitySTAR GROUP, LTD.

Incidentdiscovered Aug 24, 2021

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov