HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

NS Leasing, LLC

bd_5874eda512644646 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 8, 2019

Filed

Apr 10, 2020

To disclose

26 weeks

Affected

108state residents only

Linked

4 filings

Confidence

66%

Full breach record for NS Leasing, LLC →

NS Leasing, LLC notified the NH AG of unauthorized access to an employee email account between Oct 16-30, 2019. 108 NH residents affected. Data included names, SSNs, driver's licenses, and financial account info. NS Leasing engaged forensic specialists, secured accounts with MFA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 16, 2019

Begins

Apr 10, 2020

Filed

vs. sector median

+17 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_cc851282cded88102020-04-06 · +4dCandidate
Indiana State AGbd_e5ae535eb37e316c2020-04-06 · +4dVerified
Massachusetts State AGbd_fe3671e430a969472020-04-06 · +4dVerified

Name: NS Leasing, LLC
norm: ns leasing

Name: NS Leasing, LLC
norm: ns leasing
Industry: Financial Servicesllm

Discovered: Oct 8, 2019
Breach occurred: Oct 16, 2019 – Oct 30, 2019
Materiality determined: —
Notification sent: Apr 6, 2020
Affected individuals: 108state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney GeneralNotifying other state regulators and the three major credit reporting agencies
Initial access: valid_credentials

During the incident: Worked with outside forensic specialists to investigate the nature and scope of the activity
Secured the email account by updating all employee passwords and implementing multi-factor authentication for email account logins
Performed a thorough review of the information contained within the impacted email accounts
Began mailing written notice of this incident to one hundred and eight (108) New Hampshire residents
Offering impacted New Hampshire residents access to twelve (12) months of free credit monitoring and identity protection services through Experian
Providing impacted New Hampshire residents with guidance on how to better protect against identity theft and fraud
Notifying other state regulators and the three major credit reporting agencies about this incident
Changes made: Implementing multi-factor authentication for email account logins
Taking additional steps to improve security and better protect against similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(185 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGApr 6 · first

Indiana State AGApr 6 · first

Massachusetts State AGApr 6 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ns-leasing-20200410.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2020
Raw hash: a78fe3eed3289f93172d1aeb560efecb3058df9f855d4fcdbe374a96d98739d0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNS Leasing, LLC

Victim entityNS Leasing, LLC

Incidentdiscovered Oct 8, 2019

Stated responseWorked with outside forensic specialists to investigate the nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov