HackingTechnologyInformationVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Government IDIdentity (basic)MediumContained

Northern Jet

bd_6398be8b58a21211 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 4, 2021

Filed

Mar 12, 2021

To disclose

5 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Northern Jet →

Northern Jet Management notified the New Hampshire Attorney General of a security incident involving its third-party vendor, Avianis. Between December 6-7, 2020, an unauthorized person exploited a vulnerability in a Microsoft Azure database maintained by Avianis to exfiltrate data. Northern Jet learned on February 4, 2021, that the personal information of one New Hampshire resident (name, driver's license, passport) was copied. Northern Jet mailed a notification letter on March 11, 2021, offering one year of credit monitoring via Equifax.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 60 days

discovery → filing · 5 weeks / 36 days

Dec 6, 2020

Begins

Feb 4, 2021

Discovered

Mar 12, 2021

Filed

vs. sector median

8 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Part of Avianis supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_8481a316c8051e602021-03-11 · +1dVerified

Name: Northern Jet
norm: northern jet
Domain: northernjet.com

Name: Northern Jet
norm: northern jet
Domain: northernjet.com
Industry: Technologyllm

Discovered: Feb 4, 2021
Breach occurred: Dec 6, 2020 – Dec 7, 2020
Undetected for: 60 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 11, 2021
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Third party: via Avianis
Initial access: exploit_public_facing

During the incident: Notified law enforcement authorities
Cooperating in law enforcement investigation
Fixed the vulnerability in the Microsoft Azure database
Worked with a third-party consultant to verify the security of the Azure database
Mailed a notification letter to the New Hampshire resident
Offered a complimentary one-year membership to credit monitoring and identity theft protection services through Equifax
Changes made: Working with Avianis to better protect Northern Jet's information
Required Avianis to provide assurances that corrective actions were taken
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGMar 11 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/northern-jet-management-20210312.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2021
Raw hash: dfbd19a9538ca536512671def0bfdb906573fb2939f5e896baad50a1955d10be

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNorthern Jet

Victim entityNorthern Jet

Incidentdiscovered Feb 4, 2021

Stated responseNotified law enforcement authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov