HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

The Esco Group

bd_2cdf38ac49c20574 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 9, 2021

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for The Esco Group →

The ESCO Group, an electrical installation services provider, notified the New Hampshire Attorney General on July 9, 2021, of a cybersecurity incident occurring on November 27, 2020. An unauthorized third party gained access to ESCO systems containing employee PII, including names, SSNs, and dates of birth. One New Hampshire resident was affected. ESCO engaged forensic specialists, reset passwords, enhanced security controls (MFA, EDR), and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 27, 2020

Begins

Jul 9, 2021

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_85033a6cc3abf3d12021-07-09Verified

Name: The Esco Group
norm: the esco
Domain: theescogroup.net

Name: The Esco Group
norm: the esco
Domain: theescogroup.net
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Nov 27, 2020
Materiality determined: —
Notification sent: Jul 9, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged legal counsel and a leading incident response team
Launched a forensic investigation
Conducted an investigation with the assistance of third-party forensic specialists
Confirming the security of its IT environment
Ensured that no further unauthorized activity has continued
Changes made: Reviewed and enhanced its data security policies and procedures
Conducted global password resets
Updated password and domain admin policies
Updated firewall firmware
Added multi-factor authentication to VPN
Deployed Carbon Black endpoint detection
Added new server equipment and software
Enabled additional firewall security features
Offering credit monitoring and identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGJul 9 · first

New Hampshire State AGJul 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/esco-group-20210709.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2021
Raw hash: 9860d5b51358130fd90395f97ab87abcf494a3b06449ec51d7d6fea0053b2cef

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThe Esco Group

Victim entityThe Esco Group

IncidentUnauthorized Access

Stated responseEngaged legal counsel and a leading incident response team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov