HackingEnergy & UtilitiesFinancial ServicesUtilitiesStolen CredentialsData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Financial accountLowActive

Bonita Springs Utilities, Inc.

bd_4e99fe704c11818d · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 21, 2020

Filed

Oct 5, 2020

To disclose

6 weeks

Affected

18state residents only

Linked

4 filings

Confidence

66%

Full breach record for Bonita Springs Utilities, Inc. →2 incidents on file

Bonita Springs Utilities, Inc. (BSU) notified the NH AG of a data incident involving its third-party vendor, Technology Management Resources, Inc. (TMR). An unauthorized actor accessed TMR systems, potentially viewing check images containing customer names, financial account numbers, and routing numbers. The access occurred between Feb-May 2020. BSU notified 18 NH residents on Sept 30, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 202 days

discovery → filing · 6 weeks / 45 days

Feb 1, 2020

Begins

Aug 21, 2020

Discovered

Oct 5, 2020

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_e3693292e2ea0ae12020-10-08 · +3dVerified
Maine State AGbd_33c9ea1a93fbb1d02020-09-30 · +5dCandidate
Indiana State AGbd_fa3b6fe1c9b35b222020-09-29 · +6dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Bonita Springs Utilities, Inc.
norm: bonita springs utilities
Domain: bsu.us
Industry: Energy & UtilitiesllmFinancial Servicesllm

Discovered: Aug 21, 2020
Breach occurred: Feb 1, 2020 – May 31, 2020
Undetected for: 202 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 30, 2020
Affected individuals: 18state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney GeneralWill notify other government regulators as required
Initial access: trusted_relationship

During the incident: Commenced an investigation to determine the nature and scope of the underlying event
Requested additional information from Iberia Bank and TMR
Identified individuals whose information was contained in the check images
Provided written notice to affected New Hampshire residents
Reviewing existing policies and procedures regarding third-party vendors
Working with Iberia Bank to evaluate additional measures and safeguards
Changes made: Reviewing existing policies and procedures regarding third-party vendors
Working with Iberia Bank to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 29 · first

Maine State AG+1d

New Hampshire State AG+6d · this page

Massachusetts State AG+9d

Pattern: first filing Sep 29 (IN), last Oct 8 (MA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bonita-springs-utilities-20201005.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2020
Raw hash: 5f9dfd658ec480389a2275834613f1a032e012d5e6d64aac684e479f8f278651

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityBonita Springs Utilities, Inc.

Incidentdiscovered Aug 21, 2020

Stated responseCommenced an investigation to determine the nature and scope of the underlying event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov