MalwareHealthcareHealthcareRansomwareData EncryptedCustomer Data InvolvedPIIPHIIdentity (basic)Government IDHealth (basic)MediumContained

Cooper Aerobics Enterprises, Inc

bd_2c6b9a5de7311598 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 3, 2023

Filed

Jan 17, 2024

To disclose

50 weeks

Affected

71state residents only

Linked

4 filings

Confidence

66%

Full breach record for Cooper Aerobics Enterprises, Inc →

Cooper Aerobics Enterprises, Inc. reported a ransomware incident affecting approximately 71 New Hampshire residents. Unauthorized access occurred on February 3, 2023, and was discovered the same day. The incident involved potential access to personal and medical information, including names, addresses, dates of birth, and Social Security numbers. Cooper Aerobics contained the threat, engaged forensic investigators, and implemented various security remediation measures. Affected individuals were notified in January 2024 and offered identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 50 weeks / 348 days

Feb 3, 2023

Begins

Feb 3, 2023

Discovered

Jan 17, 2024

Filed

vs. sector median

+37 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_90b909fc2a821feb2024-01-05 · +12dCandidate
California State AGbd_aa0d549017fb36cc2024-01-05 · +12dVerified
Illinois State AGbd_33d184c08834a4882024-01-01 · +16dVerified

Name: Cooper Aerobics Enterprises, Inc
norm: cooper aerobics
Domain: cooperaerobics.com

Name: Cooper Aerobics Enterprises, Inc
norm: cooper aerobics
Domain: cooperaerobics.com
Industry: Healthcarellm

Discovered: Feb 3, 2023
Breach occurred: Feb 3, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 5, 2024
Affected individuals: 71state-resident count only
Data types: PIIPHIIdentity (basic)Government IDHealth (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Contained the threat by disabling all unauthorized access to the network
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals experienced in handling these types of incidents
Conducted a thorough and detailed manual review of all the data contained on the impacted servers
Notified potentially affected individuals
Providing written notice on or about January 5, 2024
Changes made: Changed password requirements
Amended existing and implemented new technical safeguards
Trained or retrained workforce members
Implemented periodic technical and nontechnical evaluations/risk analyses/penetration tests
Amended administrative safeguards
Implemented third-party cybersecurity monitoring and management
Implemented additional security policies related to VPN usage
Offering complimentary identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 50 weeks(348 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+4d

California State AG+4d

New Hampshire State AG+16d · this page

Pattern: first filing Jan 1 (IL), last Jan 17 (NH) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cooper-aerobics-cooper-clinic-cooper-medical-imaging-20240117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2024
Raw hash: 6a49cf5e0c04097e6c164327af3cb5dbbbb876b0950d563f9d8dd48f380516fc

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCooper Aerobics Enterprises, Inc

Victim entityCooper Aerobics Enterprises, Inc

Incidentdiscovered Feb 3, 2023

Stated responseContained the threat by disabling all unauthorized access to the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov