MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

HUPY & ABRAHAM SC

bd_239b8843b467f44b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 10, 2020

Filed

Sep 1, 2020

To disclose

12 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for HUPY & ABRAHAM SC →2 incidents on file

Hupy & Abraham, S.C. notified the NH AG of a ransomware incident affecting 1 NH resident. Unauthorized access occurred June 6-12, 2020; discovered June 10, 2020. Data included names and SSNs. Remediation included MFA deployment and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 12 weeks / 83 days

Jun 6, 2020

Begins

Jun 10, 2020

Discovered

Sep 1, 2020

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_22ed8f79bc1eea472020-08-28 · +4dVerified
Massachusetts State AGbd_934a73a6c6ed49f62020-08-28 · +4dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: HUPY & ABRAHAM SC
norm: hupy abraham sc
Industry: Professional Servicesllm

Discovered: Jun 10, 2020
Breach occurred: Jun 6, 2020 – Jun 12, 2020
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: providing notice of this event to other regulators as may be required under applicable state law

During the incident: Commenced an investigation, working with third-party forensic investigators
Reset passwords
Notify potentially impacted individuals
Offering complimentary access to 12 months of credit and identity monitoring services, including identity restoration services, through Experian
Changes made: Reviewing and enhancing existing policies and procedures
Deployment of multi-factor authentication on our VPN network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 28 · first

Massachusetts State AGAug 28 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hupy-abraham-20200901.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2020
Raw hash: 13f54c3bcda7b6c48001737aa3f537ba6b0ae82e0d3091000ed3ce085dfb0aa3

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityHUPY & ABRAHAM SC

Incidentdiscovered Jun 10, 2020

Stated responseCommenced an investigation, working with third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov