MalwareTechnologyInformationRansomwareData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

DAVACO

bd_5ae29a746abaf7a0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 11, 2021

Filed

Jul 16, 2021

To disclose

5 weeks

Affected

20state residents only

Linked

7 filings

Confidence

66%

Full breach record for DAVACO →

Davaco LP notified the New Hampshire Attorney General of a ransomware attack discovered on June 11, 2021. An unauthorized individual gained access to the network, encrypted data, and exfiltrated employee PII including names, SSNs, and driver's licenses. 20 NH residents were affected. Notifications were mailed July 2, 2021. Remediation included MFA, email upgrades, and endpoint protection. Affected individuals received credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 35 days

Jun 11, 2021

Discovered

Jul 16, 2021

Filed

vs. sector median

14 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_042657233eb077502021-07-19 · +3dVerified
Maine State AGbd_60b3867f0b16a8fa2021-07-19 · +3dVerified
California State AGbd_6400a333d4483ff52021-07-19 · +3dVerified
South Carolina State AGbd_cfb65246deff18d42021-07-19 · +3dVerified

Show 2 more filings ↓up to 14d gap

Indiana State AGbd_5d124c714000ed222021-07-02 · +14dVerified
Montana State AGbd_611f04b0c24d36c82021-07-02 · +14dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: DAVACO
norm: davaco
Domain: davaco.com
Industry: Technologyllm

Discovered: Jun 11, 2021
Materiality determined: —
Notification sent: Jul 2, 2021
Affected individuals: 20state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau

During the incident: Retained cybersecurity experts and computer forensic investigators
Notified the FBI and is cooperating with any law enforcement investigation
Offered complimentary credit and identity monitoring services through IDX
Established a toll-free call center through IDX
Provided notification to the major credit reporting agencies
Changes made: Upgrading its email environment
Implementing multi-factor authentication for accounts in the environment
Implementation of Palo Alto anti-phishing and security measures
Deployment of endpoint protection to devices in the Davaco network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGJul 2 · first

Montana State AGJul 2 · first

New Hampshire State AG+14d · this page

Massachusetts State AG+17d

Maine State AG+17d

California State AG+17d

South Carolina State AG+17d

Pattern: first filing Jul 2 (IN), last Jul 19 (SC) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/davaco-20210716.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2021
Raw hash: 21caa0738c24ae39b0f5692a1ea21c54a979149ee88321770d2b05d9058e81bd

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityDAVACO

Incidentdiscovered Jun 11, 2021

Stated responseRetained cybersecurity experts and computer forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov