HackingFinancial ServicesProfessional ServicesFinanceStolen CredentialsDelayed DiscoveryIdentity (basic)Government IDMediumContained

4A's Benefits

bd_371e5a57a40fcc2d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 19, 2018

Filed

Dec 31, 2018

To disclose

24 weeks

Affected

1state residents only

Linked

3 filings

Confidence

65%

Full breach record for 4A's Benefits →

4A's Benefits notified the NH AG of unauthorized access to an employee email account between Dec 6-12, 2017. Discovered July 19, 2018. One NH resident's PII (name, address, DOB, SSN) found in the account. Notification sent Dec 26, 2018. Remediation included MFA, email blocking software, and penetration testing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 225 days

discovery → filing · 24 weeks / 165 days

Dec 6, 2017

Begins

Jul 19, 2018

Discovered

Dec 31, 2018

Filed

vs. sector median

+15 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_63a07ba9f9aeca9c2018-12-26 · +5dVerified
Montana State AGbd_6fc7e960351ced162018-12-26 · +5dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: 4A's Benefits
norm: 4a s benefits
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: Jul 19, 2018
Breach occurred: Dec 6, 2017 – Dec 12, 2017
Undetected for: 225 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 26, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Providing notice to other state regulators and the consumer reporting agencies
Initial access: valid_credentials

During the incident: Retained a vendor to undertake an extensive and time-consuming review of the contents of the impacted email account
Offering individuals impacted by this event with access to one (1) year of complimentary credit monitoring and identity restoration services
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Reviewing its policies and procedures
Implemented additional safeguards
Passing penetration testing on all internal systems by an outside security firm
The deployment of multi-factor authentication to all 4A's Benefits email accounts
The addition of software which blocks the transmission of certain sensitive information via email either to or from 4A's Benefits emails accounts
Hardened the existing participant password rules for Retirement Plan account access
In process of deploying multi-factor authentication for the Retirement Fund Website
Changes made: Passing penetration testing on all internal systems by an outside security firm
The deployment of multi-factor authentication to all 4A's Benefits email accounts
The addition of software which blocks the transmission of certain sensitive information via email either to or from 4A's Benefits emails accounts
Hardened the existing participant password rules for Retirement Plan account access
In process of deploying multi-factor authentication for the Retirement Fund Website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(165 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 26 · first

Montana State AGDec 26 · first

New Hampshire State AG+5d · this page

Pattern: first filing Dec 26 (MA), last Dec 31 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/4as-benefits-20181231.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 31, 2018
Raw hash: 5696804a18645109b2d0a1ae8fd0e8fdb9a8b965899176c621f318aa2c1582f8

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entity4A's Benefits

Incidentdiscovered Jul 19, 2018

Stated responseRetained a vendor to undertake an extensive and time-consuming review of the contents of the impacted email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov