MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)EmploymentMediumActive

The North Highland Holding Company LLC

bd_4a5a5be8d6ceb777 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2022

Filed

Sep 23, 2022

To disclose

16 weeks

Affected

1state residents only

Linked

7 filings

Confidence

66%

Full breach record for The North Highland Holding Company LLC →

North Highland Company LLC experienced a ransomware attack discovered on June 6, 2022, impacting on-premises servers. Attackers gained access around May 26, 2022, and exfiltrated personal information of current and former employees, including dependents and beneficiaries. Data exposed includes names, SSNs, bank account numbers, health information, and employment records. The company engaged forensic experts, notified law enforcement, implemented new password requirements, and offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 16 weeks / 109 days

May 26, 2022

Begins

Jun 6, 2022

Discovered

Sep 23, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_43b6cf6e213c68162022-09-26 · +3dVerified
Maine State AGbd_b03ec36e53e8b9ba2022-09-26 · +3dVerified
Oregon State AGbd_cd7f068cb537a6892022-09-26 · +3dVerified
Oregon State AGbd_52c6629a73a1db9d2022-07-29 · +56dVerified

Show 2 more filings ↓up to 57d gap

Massachusetts State AGbd_976dd13c4d3300812022-07-28 · +57dVerified
Maine State AGbd_f6fd1512ab6ececb2022-07-28 · +57dCandidate

Name: The North Highland Holding Company LLC
norm: the north highland
Domain: northhighland.com

Name: The North Highland Holding Company LLC
norm: the north highland
Domain: northhighland.com
Industry: Professional Servicesllm

Discovered: Jun 6, 2022
Breach occurred: May 26, 2022
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Employment
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Engaged external cybersecurity experts to help with the investigation and remediation of the incident
Notified law enforcement of the attack
Initiated a number of technical remediation efforts, including new password requirements for all employees
Arranged to provide certain identity protection services to impacted employees, former employees, dependents and beneficiaries through Experian
Changes made: New password requirements for all employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(109 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 28 · first

Maine State AGJul 28 · first

Oregon State AG+1d

Montana State AG+57d · this page

California State AG+60d

Maine State AG+60d

Oregon State AG+60d

Pattern: first filing Jul 28 (MA), last Sep 26 (OR) — a 60-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-582.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2022
Raw hash: bf745c318bd7e2ea283a29eb1d735ecff613139f5ab25603169fe0b80c4b1cf7

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityThe North Highland Holding Company LLC

Victim entityThe North Highland Holding Company LLC

Incidentdiscovered Jun 6, 2022

Stated responseEngaged external cybersecurity experts to help with the investigation and remediation of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov