HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Dirigo Management Company

bd_5fb6b3e97b05a69b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2022

Filed

Sep 27, 2022

To disclose

17 weeks

Affected

5state residents only

Linked

4 filings

Confidence

67%

Full breach record for Dirigo Management Company →

Dirigo Management Company notified NH AG of a data breach affecting 5 NH residents. Unauthorized access to 4 email accounts occurred in June 2022. Data included names, DOBs, addresses, SSNs, and driver's licenses. Dirigo engaged forensic investigators, disabled accounts, and offered 1-year Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 118 days

Jun 1, 2022

Discovered

Sep 27, 2022

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_c0af4f51fac29dfa2022-09-27Verified
Maine State AGbd_3ebca4952930edba2022-09-23 · +4dCandidate
Maine State AGbd_3835e491c36aadad2022-10-13 · +16dCandidate

Name: Dirigo Management Company
norm: dirigo management
Domain: dirigomgmt.com

Name: Dirigo Management Company
norm: dirigo management
Domain: dirigomgmt.com
Industry: Professional Servicesllm

Discovered: Jun 1, 2022
Materiality determined: —
Notification sent: Sep 23, 2022
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Provided notice to the Office of the Attorney General, Consumer Protection and Antitrust Bureau
Initial access: valid_credentials

During the incident: Engaged legal counsel with an expertise in cyber security
Retained a nationally-recognized digital forensics and cyber security firm to assist with the investigation
Disabled the affected email accounts
Reset passwords
Scanned our email system to detect and terminate unauthorized activity
Changes made: Closely monitoring and restricting outside access to its systems
Increasing password complexity requirements
Expanding multi-factor authentication to additional employee accounts
Enhancing network intrusion detection and response
Strengthening email filtering to help block dangerous emails
Enhancing its cyber training and providing regular communications in order to increase cyber awareness
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Maine State AGSep 23 · first

Massachusetts State AG+4d

New Hampshire State AG+4d · this page

Maine State AG+20d

Pattern: first filing Sep 23 (ME), last Oct 13 (ME) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/dirigo-management-20220927.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2022
Raw hash: 9ca3d547f933e0ef2b3fca645201b75fe9980c25f1b6eca8e1b6ea21b8eccac4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDirigo Management Company

Victim entityDirigo Management Company

Incidentdiscovered Jun 1, 2022

Stated responseEngaged legal counsel with an expertise in cyber security

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov