Social EngineeringFinancial ServicesFinancePhishingEmotetData ExfiltratedCustomer Data InvolvedMulti-Stage ChainPIIIdentity (basic)Government IDCredentialsMediumContained

CANTELLA & CO.,INC.

bd_47cef584df20f319 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 25, 2020

Filed

Nov 17, 2020

To disclose

12 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for CANTELLA & CO.,INC. →

Cantella & Co., Inc. reported a cybersecurity incident to the New Hampshire Department of Justice on November 16, 2020, regarding an Emotet malware infection detected on August 25, 2020. The incident involved phishing emails with malicious .doc attachments that infected 23 computers (10 home office, 13 advisors). The malware exfiltrated email strings and potentially client PII (names, addresses, SSNs) and credentials. Cantella notified clients, offered two years of credit monitoring via Experian, and engaged external forensic partners. All infected machines were wiped and rebuilt, and passwords were reset.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 12 weeks / 83 days

Aug 25, 2020

Begins

Aug 25, 2020

Discovered

Nov 17, 2020

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_041fe2fc8d4fcade2020-11-11 · +6dVerified
California State AGbd_386705a1849002e72020-11-10 · +7dCandidate

Name: CANTELLA & CO.,INC.
norm: cantella

Name: CANTELLA & CO.,INC.
norm: cantella
Industry: Financial Servicesllm

Discovered: Aug 25, 2020
Breach occurred: Aug 25, 2020 – Aug 25, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 16, 2020
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDCredentials
Attack vector: Phishing
MITRE ATT&CK: T1566.001 Spearphishing AttachmentT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice
Initial access: phishing_attachment

During the incident: Engaged Partner-A and Partner-B (cybersecurity experts) for continuous assistance
Notified the entire Cantella user base via email and text
Submitted suspicious .doc malware to VirusTotal for analysis
Banned .doc files from email gateways
Took Windows shares offline
Disabled access to network shares for everyone
Changed passwords for all home office personnel
Wiped and rebuilt all 23 infected computers
Reinstalled Windows on infected machines
Reset passwords for infected users
Changes made: Implemented email policy to block macro documents
Modified firewall policies to drop traffic to email systems with executable attachments
Configured firewall to decrypt SSL/TLS-based email traffic
Enabled macro detection module within anti-spam software
Enhanced password reuse testing to include dictionary checks and character reuse
Prohibited common terms (e.g., Cantella) from appearing in passwords
Implemented internal policy requiring employees to share cell phone numbers and update IT
Conducted regular cybersecurity training for home office and advisors
Disabled MS Office macros on computers as a standard policy
Investigated third-party technologies (Cortex, Palo Alto, Mimecast) to block compromised users
Reviewed extending log retention period from four weeks to eight weeks
Created documentation for emergency changes and infection protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGNov 10 · first

Massachusetts State AG+1d

New Hampshire State AG+7d · this page

Pattern: first filing Nov 10 (CA), last Nov 17 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cantella-20201117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2020
Raw hash: 421aee5d39ec950eecf3258b2c522f8b325ee8016afa2a6e6fbb80c569aa2ede

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCANTELLA & CO.,INC.

Victim entityCANTELLA & CO.,INC.

Incidentdiscovered Aug 25, 2020

Stated responseEngaged Partner-A and Partner-B (cybersecurity experts) for continuous assistance

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov