MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Pinova Holdings, Inc.

bd_6393e15c9d5b7a97 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 24, 2021

Filed

Oct 1, 2021

To disclose

5 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Pinova Holdings, Inc. →

Pinova, Inc. experienced a ransomware attack detected on August 24, 2021. Investigation revealed unauthorized access to files on June 30, 2021. The incident affected one New Hampshire resident, involving name, SSN, DOB, address, and/or driver's license number. Pinova engaged legal and cybersecurity experts, alerted law enforcement, and implemented remediation measures including MFA expansion and password resets. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 55 days

discovery → filing · 5 weeks / 38 days

Jun 30, 2021

Begins

Aug 24, 2021

Discovered

Oct 1, 2021

Filed

vs. sector median

13 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_8abf3ce89fb93b512021-09-28 · +3dCandidate
Massachusetts State AGbd_8c5c9acb86c106742021-09-28 · +3dVerified
Indiana State AGbd_fc650d60e2abda892021-09-28 · +3dVerified

Name: Pinova, Inc.
norm: pinova
Domain: www.pinovasolutions.com

Name: Pinova Holdings, Inc.
norm: pinova holdings
Domain: pinovasolutions.com
Industry: Professional Servicesllm

Discovered: Aug 24, 2021
Breach occurred: Jun 30, 2021
Undetected for: 55 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 28, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Providing notice of this incident to appropriate state regulators, including your office

During the incident: Engaged legal counsel with an expertise in data security
Launched an investigation into the incident
Alerted law enforcement
Hired cybersecurity experts to assist with the investigation
Changes made: Closely monitoring and implementing higher restrictions on outside access to our network
Initiating a global password reset exercise in order to achieve strong and unique passwords
Enhancing network intrusion detection and response
Expanding multi-factor authentication requirements to access digital services for employee accounts
Strengthening our email filtering security services to help block dangerous emails
Increasing security requirements around allowed workstations
Increased frequency of security software patching
Updating our incident response procedures to more quickly and effectively respond to incidents
Enhancing our employee cyber security training and providing regular communications in order to increase cyber awareness
Offering 2 years of credit monitoring at no cost to the individual
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 28 · first

Indiana State AGSep 28 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pinova-20211001.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2021
Raw hash: b001afbe3c3cff49afd79985ebff5eb5796e3a0367e323c2f744c4eb02182a87

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPinova, Inc.

Victim entityPinova Holdings, Inc.

Incidentdiscovered Aug 24, 2021

Stated responseEngaged legal counsel with an expertise in data security

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov