MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedIdentity (basic)Government IDMediumContained

Tax Sheltered Compensation, Inc.

bd_5898c3f253000b2e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2021

Filed

Jun 21, 2021

To disclose

22 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for Tax Sheltered Compensation, Inc. →

Tax Sheltered Compensation, Inc. notified the NH AG of a third-party ransomware incident involving cloud host Netgain. Unauthorized access occurred late Sept 2020 through Dec 2020, with data exfiltration confirmed. TSC discovered the incident on Jan 15, 2021. One NH resident affected; data included names, SSNs, and DOBs. TSC provided 12 months of Kroll credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 136 days

discovery → filing · 22 weeks / 157 days

Sep 1, 2020

Begins

Jan 15, 2021

Discovered

Jun 21, 2021

Filed

vs. sector median

+14 wks slower

This filing is one of 5 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_53661d65b456ae752021-06-15 · +6dVerified
Maine State AGbd_17a8c512b8891d652021-06-14 · +7dCandidate
Montana State AGbd_a0adda5b3740c0df2021-06-14 · +7dVerified by operator
Massachusetts State AGbd_ab88ecc17ff84bca2021-06-14 · +7dVerified

Name: Tax Sheltered Compensation, Inc.
norm: tax sheltered compensation

Name: Tax Sheltered Compensation, Inc.
norm: tax sheltered compensation
Industry: Financial Servicesllm

Discovered: Jan 15, 2021
Breach occurred: Sep 1, 2020 – Dec 3, 2020
Undetected for: 136 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Third party: via Netgain
Initial access: supply_chain

During the incident: Conducted an extensive review of the entire contents of the impacted files
Notified impacted clients
Provided notice to impacted individuals and regulators
Provided access to credit monitoring services for twelve (12) months through Kroll
Provided guidance on how to better protect against identity theft and fraud
Working to implement additional safeguards and training to its employees
Changes made: Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(157 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGJun 14 · first

Montana State AGJun 14 · first

Massachusetts State AGJun 14 · first

Indiana State AG+1d

New Hampshire State AG+7d · this page

Pattern: first filing Jun 14 (ME), last Jun 21 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tax-sheltered-compensation-20210621.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2021
Raw hash: 6f8891ccbad9878b1af3a3892d8c6a1f62c9e1dc80d2d0c6c7323714489212d2

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTax Sheltered Compensation, Inc.

Victim entityTax Sheltered Compensation, Inc.

Incidentdiscovered Jan 15, 2021

Stated responseConducted an extensive review of the entire contents of the impacted files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov