MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedRansom DemandedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

KIND Inc.

bd_4d4dd9824011ba76 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 8, 2021

Filed

Jan 11, 2022

To disclose

9 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for KIND Inc. →

KIND LLC notified the NH AG of a ransomware incident affecting its third-party vendor, FML. The attack occurred Sept 9-14, 2021. KIND became aware on Nov 8, 2021. FML systems holding KIND employee names and SSNs were potentially copied. 2 NH residents were notified on Jan 7, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 60 days

discovery → filing · 9 weeks / 64 days

Sep 9, 2021

Begins

Nov 8, 2021

Discovered

Jan 11, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_6ce29915d0798a602022-01-08 · +3dCandidate
Indiana State AGbd_30525d4f614714822022-01-07 · +4dVerified
Massachusetts State AGbd_a72844ac166b70042022-01-07 · +4dVerified

Name: KIND Inc.
norm: kind

Name: KIND Inc.
norm: kind
Industry: Retail & Consumerllm

Discovered: Nov 8, 2021
Breach occurred: Sep 9, 2021 – Sep 14, 2021
Undetected for: 60 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 7, 2022
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: FML reported this incident to federal law enforcementFML is notifying relevant regulatory authoritiesKIND provided notification to the New Hampshire Attorney General

During the incident: FML reported the incident to federal law enforcement
FML is notifying relevant regulatory authorities
FML is offering complimentary access to Experian IdentityWorks for [x] months
KIND is sending out its own notice to affected individuals
Changes made: FML has put in place additional security controls to protect against future attacks
FML is reviewing and enhancing existing policies and procedures
FML is implementing additional safeguards to further secure the information in its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJan 7 · first

Massachusetts State AGJan 7 · first

Maine State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kind-20220111.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2022
Raw hash: afa2799aae64a16d51672ae0373831c59c530a0578eb6a7978c60d0e1137cdaa

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityKIND Inc.

Victim entityKIND Inc.

Incidentdiscovered Nov 8, 2021

Stated responseFML reported the incident to federal law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov