MalwareFinancial ServicesFinanceRansomwareData EncryptedRansom DemandedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountMediumActive

Kaye-Smith

bd_2948007228e73a07 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 3, 2022

Filed

Jul 1, 2022

To disclose

28 days

Affected

15state residents only

Confidence

66%

Full breach record for Kaye-Smith →2 incidents on file

Nations Lending reported a ransomware attack on third-party vendor Kaye Smith, Inc. in late May 2022. The incident affected 15 New Hampshire residents, exposing names, addresses, SSNs, emails, and asset information. Nations Lending suspended the vendor, moved operations in-house, and provided one year of free credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 28 days

May 27, 2022

Begins

Jun 3, 2022

Discovered

Jul 1, 2022

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed15 affectedView incident

Name: Nations Lending Corporation
norm: nations lending
Domain: nationslending.com

Name: Kaye-Smith
norm: kaye smith
Industry: Financial Servicesllm

Discovered: Jun 3, 2022
Breach occurred: May 27, 2022
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2022
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Suspended any further transactions with Kaye-Smith
Moved print/mail activities in-house
Secured the services of Kroll to provide identity monitoring at no cost to the customer for one year
Changes made: Review of Kaye-Smith’s WISP will be conducted prior to resuming any use of their services
Before resuming any business transactions with Kaye-Smith, they would have to pass a complete cybersecurity evaluation and demonstrate that their systems and personnel are hardened against any further attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kaye-smith-20220701.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 1, 2022
Raw hash: 25d31e62a96d55de3a766e4af6a65958e7e81d5b192509bd269fd4328854e33c

Reporting entityNations Lending Corporation

Victim entityKaye-Smith

Incidentdiscovered Jun 3, 2022

Stated responseSuspended any further transactions with Kaye-Smith

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov