MalwareEnergy & UtilitiesUtilitiesRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDPIIMediumContained

NATIONAL FUEL GAS DISTRIBUTION CORPORATION

bd_3c16c2a72bc88e37 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 8, 2020

Filed

Sep 28, 2020

To disclose

20 days

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for NATIONAL FUEL GAS DISTRIBUTION CORPORATION →

National Fuel Gas Distribution Corporation notified the NH Attorney General of a ransomware attack on third-party vendor DiVal Safety Equipment Inc. Unauthorized access occurred July 28-30, 2020. One NH resident's PII (name, address, phone, account number, SSN) was potentially exposed. National Fuel is offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 42 days

discovery → filing · 20 days

Jul 28, 2020

Begins

Sep 8, 2020

Discovered

Sep 28, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_0308957333cc6e302020-09-23 · +5dCandidate
Massachusetts State AGbd_9abaedbea7affd092020-09-23 · +5dVerified
Montana State AGbd_d3628fdc675478ae2020-09-23 · +5dVerified
Maine State AGbd_73b90c3e47e417552020-09-18 · +10dCandidate

Name: NATIONAL FUEL GAS DISTRIBUTION CORPORATION
norm: national fuel gas distribution

Name: NATIONAL FUEL GAS DISTRIBUTION CORPORATION
norm: national fuel gas distribution
Industry: Energy & Utilitiesllm

Discovered: Sep 8, 2020
Breach occurred: Jul 28, 2020 – Jul 30, 2020
Undetected for: 42 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the Office of the Attorney General in accordance with N.H. Rev. Stat. § 359-C:19 et seq.

During the incident: Launched its own investigation
Worked with DiVal to determine whether any National Fuel customers' data may have been involved
Conducted a thorough analysis to determine the scope of National Fuel customers' personal information potentially contained on the affected DiVal system
Began sending notification letters via First Class Mail
Offering one year of complimentary credit monitoring and identity protection services
Provided a toll free hotline for the individuals to call with any questions
Changes made: DiVal implemented an advanced endpoint detection and response tool
DiVal implemented multi-factor authentication for remote access to email
National Fuel is continuing to work with DiVal to evaluate additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGSep 18 · first

Maine State AG+5d

Massachusetts State AG+5d

Montana State AG+5d

New Hampshire State AG+10d · this page

Pattern: first filing Sep 18 (ME), last Sep 28 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/national-fuel-gas-distribution-20200928.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 28, 2020
Raw hash: bec2c71f30880cb2079a3672ec3d2c27acde71aa9af87ca0c9bc21afbe5317d8

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityNATIONAL FUEL GAS DISTRIBUTION CORPORATION

Victim entityNATIONAL FUEL GAS DISTRIBUTION CORPORATION

Incidentdiscovered Sep 8, 2020

Stated responseLaunched its own investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov