HackingProfessional ServicesProfessional ServicesStolen CredentialsEmployee Data InvolvedCustomer Data InvolvedGovernment IDIdentity (basic)Health (basic)MediumActive

Drug Free Workplaces

bd_5070856c93dfda08 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Nov 2, 2023

To disclose

—

Affected

9state residents only

Linked

6 filings

Confidence

66%

Full breach record for Drug Free Workplaces →

Drug Free Workplaces USA notified the NH Attorney General that an unauthorized individual accessed two employee email accounts between March 29, 2023, and May 4, 2023. The incident affected approximately 9 New Hampshire residents, exposing Social Security numbers, basic identity information, and medical information. The company engaged outside cybersecurity professionals, concluded its investigation on September 29, 2023, and began notifying affected individuals on October 27, 2023. Credit monitoring and identity theft protection services were offered.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 29, 2023

Begins

Nov 2, 2023

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_102259a7fe4b427f2023-10-27 · +6dVerified
Maine State AGbd_27a05a4bca8616ec2023-10-27 · +6dVerified by operator
California State AGbd_7c980389ee4fad0a2023-10-27 · +6dVerified
Montana State AGbd_0b61ca403f5b92722023-10-26 · +7dCandidate

Show 1 more filing ↓up to 7d gap

Vermont State AGbd_4a8f74a43edb3b0d2023-10-26 · +7dVerified

Name: Drug Free Workplaces
norm: drug free workplaces
Domain: drugfreeworkplaces.com

Name: Drug Free Workplaces
norm: drug free workplaces
Domain: drugfreeworkplaces.com
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Mar 29, 2023 – May 4, 2023
Materiality determined: —
Notification sent: Oct 27, 2023
Affected individuals: 9state-resident count only
Data types: Government IDIdentity (basic)Health (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Provided written notification of this incident to affected residents
Offered complimentary one-year memberships with a credit monitoring service
Advised affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Provided contact information for the consumer reporting agencies and the Federal Trade Commission
Provided steps to take to safeguard themselves against medical identity theft
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 26 · first

Vermont State AGOct 26 · first

Indiana State AG+1d

Maine State AG+1d

California State AG+1d

New Hampshire State AG+7d · this page

Pattern: first filing Oct 26 (MT), last Nov 2 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/drug-free-workplaces-usa-20231102.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 2, 2023
Raw hash: 267eba885a71b2fcc36c8cc457bd4199649651e2efd123712e7d57ebb12b6bc8

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDrug Free Workplaces

Victim entityDrug Free Workplaces

IncidentUnauthorized Access

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov