HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedPIIIdentity (basic)LowContained

Water For People

bd_328e5b2385a6a76d · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 15, 2023

Filed

Sep 5, 2024

To disclose

38 weeks

Affected

26state residents only

Linked

8 records

Confidence

66%

Full breach record for Water For People →

Water For People notified the NH AG of a security breach discovered on Dec 15, 2023, involving unauthorized access to computer systems. 26 NH residents were affected, with potential access to personal information. The organization engaged forensic investigators, secured systems, and offered credit monitoring. Notification was sent on Sep 5, 2024.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d38 weeks discovery → filing

Incident timeline

discovery → filing · 38 weeks / 265 days

Dec 15, 2023

Discovered

Sep 5, 2024

Filed

vs. sector median

+18 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by medusa about this victim was first seen 238 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_b8955f0cd698c83e2023-12-15 · +265dVerified by operator

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_1f8df32e54c704c82024-09-05Verified
Montana State AGbd_2f77e69a7542f2f82024-09-05Candidate
Indiana State AGbd_8937325be81321412024-09-05Verified
Washington State AGbd_fcdf66f98c82eef32024-09-05Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_d16592a54ea711c12024-09-06 · +1dVerified by operator

Press reports (1)

Pressmedusabd_f6127a1f201b04702023-12-15 · +265dCandidate

Name: Water For People
norm: water for people
Domain: waterforpeople.org

Name: Water For People
norm: water for people
Domain: waterforpeople.org
Industry: Professional Servicesllm

Discovered: Dec 15, 2023
Materiality determined: —
Notification sent: Sep 5, 2024
Affected individuals: 26state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau

During the incident: Secured its systems
Engaged a third-party forensic firm to investigate the incident
Secured our network and swiftly engaged a third-party team of forensic investigators
Provided written notification to the potentially impacted New Hampshire residents via First Class Mail
Offered complimentary credit monitoring and identity protection services
Changes made: Enhance the security of our network to prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(265 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGSep 5 · first

Montana State AGSep 5 · first

Indiana State AGSep 5 · first

Washington State AGSep 5 · first

New Hampshire State AGSep 5 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/water-people-20240905.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2024
Raw hash: 2f64ca41a0d22e553c8cf4feb9d5cf3a188cb9df2003db0dc06551b0d230a7ff

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Press reports (1)

Reporting entityWater For People

Victim entityWater For People

Incidentdiscovered Dec 15, 2023

Stated responseSecured its systems

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov