HackingManufacturingManufacturingStolen CredentialsEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

Sponge-Jet Realty Holdings, LLC

bd_533aac73c25a6849 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 25, 2024

Filed

Jun 27, 2024

To disclose

13 weeks

Affected

24state residents only

Linked

3 filings

Confidence

66%

Full breach record for Sponge-Jet Realty Holdings, LLC →

Sponge-Jet, Inc., a manufacturer of abrasive blasting media, notified the NH Attorney General of a data security incident on March 25, 2024. An unauthorized third party accessed a portion of the company's Dropbox account, potentially exposing HR records of 24 New Hampshire residents (current and former employees). The data may include names, addresses, Social Security numbers, and dates of birth. The company shut down access, expelled the intruder, engaged forensic experts, and is offering 24 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 94 days

Mar 25, 2024

Begins

Mar 25, 2024

Discovered

Jun 27, 2024

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_22e1b49bcc872eea2024-06-27Verified
Maine State AGbd_5fecca610199435e2024-06-27Candidate

Name: Sponge-Jet Realty Holdings, LLC
norm: sponge jet realty

Name: Sponge-Jet Realty Holdings, LLC
norm: sponge jet realty
Industry: Manufacturingllm

Discovered: Mar 25, 2024
Breach occurred: Mar 25, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 27, 2024
Affected individuals: 24state-resident count only
Data types: Identity (basic)Government IDEmployment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Shut down access to Dropbox
Expelled the third-party
Scanned the environment to ensure its ongoing security
Engaged McLane Middleton as its cybersecurity attorneys and a forensic expert
Notified all of its employees about this cybersecurity incident
Offering 24 months of identity theft protection and credit monitoring services through IDX at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJun 27 · first

Maine State AGJun 27 · first

New Hampshire State AGJun 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sponge-jet-20240627.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 27, 2024
Raw hash: 3085cd8a345c65a5c10c198dba4ead67f8e05bf0e1e2685956fa61fef189110e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySponge-Jet Realty Holdings, LLC

Victim entitySponge-Jet Realty Holdings, LLC

Incidentdiscovered Mar 25, 2024

Stated responseShut down access to Dropbox

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov