HackingOtherStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsMediumContained

Tavistock Development Company, LLC

bd_4ad3383e549cbd62 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2022

Filed

Oct 5, 2022

To disclose

26 weeks

Affected

24state residents only

Linked

6 filings

Confidence

66%

Full breach record for Tavistock Development Company, LLC →

Tavistock Development Company, LLC notified the New Hampshire Attorney General of a data security incident detected on April 6, 2022. Unauthorized access resulted in the potential exposure of personal data for 24 NH residents, including SSNs, driver's licenses, payment card info, and credentials. Notifications were mailed on September 29, 2022, offering 12 months of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 182 days

Apr 6, 2022

Begins

Apr 6, 2022

Discovered

Oct 5, 2022

Filed

vs. sector median

+18 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_547c126eb8fa85062022-10-03 · +2dCandidate
Massachusetts State AGbd_2ae9e1aa4e0feb172022-10-10 · +5dVerified
Massachusetts State AGbd_836c2676cfa93b152022-10-10 · +5dVerified
Indiana State AGbd_4c69713a6ceab68d2022-09-29 · +6dVerified

Show 1 more filing ↓up to 6d gap

Indiana State AGbd_fd233b09ed0fa47c2022-09-29 · +6dCandidate

Name: Tavistock Development Company, LLC
norm: tavistock development

Name: Tavistock Development Company, LLC
norm: tavistock development
Industry: Otherllm

Discovered: Apr 6, 2022
Breach occurred: Apr 6, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 29, 2022
Affected individuals: 24state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of Attorney General
Initial access: valid_credentials

During the incident: Conducted a thorough forensic analysis and investigation
Contained, and eliminating the unauthorized individual's(s') access to its systems
Implemented additional security measures to further fortify its network’s security measures and protocols
Enhancing administrative and technical safeguards
Expanding the use of multi-factor authentication
More frequent and rigorous training of employees on avoiding phishing attempts
Additional filtering of malicious links and impersonation protection policies
Enhancing network monitoring
Established a dedicated call center service to assist affected residents
Offering complimentary access to 12 months of identity theft protection services through Kroll Essential Monitoring Services
Changes made: Enhancing administrative and technical safeguards
Expanding the use of multi-factor authentication
More frequent and rigorous training of employees on avoiding phishing attempts
Additional filtering of malicious links and impersonation protection policies
Enhancing network monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(182 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Indiana State AGSep 29 · first

Maine State AG+4d

New Hampshire State AG+6d · this page

Massachusetts State AG+11d

Pattern: first filing Sep 29 (IN), last Oct 10 (MA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tavistock-development-20221005.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2022
Raw hash: 3fa4f495e57c151e117867b1972264d5c65474a4079f71837436faab364d05da

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityTavistock Development Company, LLC

Victim entityTavistock Development Company, LLC

Incidentdiscovered Apr 6, 2022

Stated responseConducted a thorough forensic analysis and investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov