Social EngineeringOtherPhishingBECTargetedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Evening Post Industries, Inc.

bd_3f9180f52270c867 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2016

Filed

Mar 3, 2016

To disclose

6 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Evening Post Industries, Inc. →

Evening Post Industries experienced a targeted email spoofing incident on February 26, 2016, where an attacker impersonating the CEO requested and received 2015 employee W-2 information. The compromised data included names, addresses, Social Security numbers, and wage information. The company notified affected employees via email on February 27, 2016, and began mailing written notices on March 3, 2016. Two years of credit monitoring were offered. The investigation is ongoing but the incident is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 5 days

Feb 26, 2016

Begins

Feb 26, 2016

Discovered

Mar 3, 2016

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_778c95271440a5c12016-02-27 · +5dCandidate

Name: Evening Post Industries
norm: evening post industries

Name: Evening Post Industries, Inc.
norm: evening post
Industry: Otherllm

Discovered: Feb 26, 2016
Breach occurred: Feb 26, 2016 – Feb 26, 2016
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 27, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProviding written notice of this incident to other state regulatorsNotifying law enforcement
Initial access: phishing_link

During the incident: Notified all current employees who may have been affected by this incident via email
Holding meetings with affected current employees to discuss the incident and ways to protect against misuse of the information involved
Providing written notice of this incident to all affected current and former employees
Providing all potentially affected individuals access to two (2) free years of credit and identity monitoring services, including identity restoration services, through Experian
Established a dedicated hotline for potentially affected individuals to contact with questions or concerns regarding this incident
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to other state regulators and the national consumer reporting agencies as necessary
Notified our Board of Directors of the attack
Notified Division Heads
Notified and engaged our external auditors
Consulted with our cyber security advisors on how to best provide prompt notice of this incident
Notifying law enforcement and certain state regulators about this incident
Changes made: Working to implement additional safeguards
Providing additional mandatory training to our employees on safeguarding the privacy and security of information on our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGFeb 27 · first

New Hampshire State AG+5d · this page

Pattern: first filing Feb 27 (MT), last Mar 3 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/evening-post-20160303.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2016
Raw hash: 81cdd56e445f903208b07c4813e7e203dc56993ad085788cff157bf5aae24454

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEvening Post Industries

Victim entityEvening Post Industries, Inc.

Incidentdiscovered Feb 26, 2016

Stated responseNotified all current employees who may have been affected by this incident via email

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov