HackingGovernmentGovernmentStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Board of Public Works City of Lewes

bd_54260341aaa34a0e · schema v1 · pii pii-v1

Severity

Low

Discovered

May 28, 2019

Filed

Oct 3, 2019

To disclose

18 weeks

Affected

2state residents only

Linked

2 filings

Confidence

67%

Full breach record for Board of Public Works City of Lewes →2 incidents on file

The Board of Public Works for the City of Lewes notified the NH Attorney General that payment card and financial account data for 2 NH residents was found on the dark web. The incident was discovered on May 28, 2019, and notifications were sent in October 2019. The organization engaged forensic investigators and cooperated with the FBI and Secret Service.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 weeks / 128 days

May 28, 2019

Discovered

Oct 3, 2019

Filed

vs. sector median

+7 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_4e8bb8d37344e6d92019-10-04 · +1dVerified

Name: Board of Public Works City of Lewes
norm: board of public works city of lewes
Industry: government_public

Name: Board of Public Works City of Lewes
norm: board of public works city of lewes
Industry: government_public
Industry: Governmentllm

Discovered: May 28, 2019
Materiality determined: —
Notification sent: Oct 3, 2019
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified FBICooperating with U.S. Secret Service
Initial access: valid_credentials

During the incident: Secured its system
Launched an investigation with the assistance of an independent digital forensics firm
Notified the major payment card brands (American Express, Discover, MasterCard, and Visa)
Cooperating with the FBI and U.S. Secret Service
Notified the affected New Hampshire residents via the attached sample letter
Offered twelve (12) months of complimentary credit monitoring services through LifeLock
Changes made: Implemented numerous enhanced security features
Continues to work internally and with external cybersecurity resources to help prevent a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(128 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 3 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lewes-board-public-works-20191003.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2019
Raw hash: 4f5f6fd18de59a41772a2724d85ddfe1fee3d094a141d23e5921a866e6267fbf

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBoard of Public Works City of Lewes

Victim entityBoard of Public Works City of Lewes

Incidentdiscovered May 28, 2019

Stated responseSecured its system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov