HackingGovernmentFinancial ServicesGovernmentStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

New Hampshire Deferred Compensation Commission

bd_2fad8dfb88172581 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 24, 2017

Filed

Aug 16, 2017

To disclose

23 days

Affected

Confidence

66%

Full breach record for New Hampshire Deferred Compensation Commission →2 incidents on file

NH Deferred Compensation Commission notified NH DOJ of unauthorized access to a single retired participant's account. An unknown individual used personal data to register for online access on July 17, 2017. Participant reported unauthorized access on July 24. Account was locked, no funds misdirected. Account number and balance exposed. Official notice mailed August 16, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 23 days

Jul 17, 2017

Begins

Jul 24, 2017

Discovered

Aug 16, 2017

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: New Hampshire Deferred Compensation Commission
norm: new hampshire deferred compensation commission
Domain: nhdcp.com
Industry: government_public

Name: New Hampshire Deferred Compensation Commission
norm: new hampshire deferred compensation commission
Domain: nhdcp.com
Industry: government_public
Industry: GovernmentllmFinancial Servicesllm

Discovered: Jul 24, 2017
Breach occurred: Jul 17, 2017
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 16, 2017
Affected individuals: 1state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of JusticeReported incident to state and federal law enforcement agencies
Initial access: valid_credentials

During the incident: Reported this incident to both state and federal law enforcement agencies
Instituted additional procedures to verify online transactions
Terminated unauthorized online access
Locked the affected account
Undertook immediate steps to investigate and verify all recent online account registrations, loans, and distributions
Changes made: Continuing to work with record keeper in reviewing security protocols for initial online access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nh-deferred-compensation-20170816.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2017
Raw hash: c672deae3a9b79e6d6c38f1b0216b1691e42cfc81cb2c577005bb67792a9a739

Reporting entityNew Hampshire Deferred Compensation Commission

Victim entityNew Hampshire Deferred Compensation Commission

Incidentdiscovered Jul 24, 2017

Stated responseReported this incident to both state and federal law enforcement agencies

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov