Social EngineeringFinancial ServicesFinancePhishingData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

BARD ASSOCIATES LLC

bd_67fbdf5c0d2be257 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 10, 2022

Filed

Jan 28, 2022

To disclose

18 days

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for BARD ASSOCIATES LLC →

Bard Associates, Inc. notified the New Hampshire Attorney General of a cybersecurity incident affecting two NH residents. An unauthorized party gained access to employee email accounts starting July 8, 2021, via phishing, redirecting emails containing client PII (names, SSNs, addresses, brokerage numbers). Bard contained the breach, alerted law enforcement, and notified clients on January 12, 2022, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 186 days

discovery → filing · 18 days

Jul 8, 2021

Begins

Jan 10, 2022

Discovered

Jan 28, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_3a58e5a474ae4a0d2022-01-28Verified
Maine State AGbd_7c5674fd8db97a0d2022-01-28Candidate
Maine State AGbd_0ad5d22fedce85b32022-01-25 · +3dCandidate
Indiana State AGbd_c54b05b6901994f72022-01-21 · +7dVerified

Name: BARD ASSOCIATES LLC
norm: bard associates

Name: BARD ASSOCIATES LLC
norm: bard associates
Industry: Financial Servicesllm

Discovered: Jan 10, 2022
Breach occurred: Jul 8, 2021
Undetected for: 186 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 12, 2022
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Disabled the unauthorized individual’s access to the affected email accounts
Improved access controls for employees
Enhanced deployment of its multifactor authentication efforts
Changed all passwords to its email system
Increased the monitoring of its networks
Hardened its systems
Notified its custodian financial organizations
Requested enhanced monitoring from these organizations
Alerted law enforcement
Began investigating with the assistance of third-party cybersecurity experts
Changes made: Offering identity theft protection services through IDX
24 Months of triple bureau credit monitoring
$1,000,000 Insurance reimbursement policy
Fully managed ID theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGJan 21 · first

Maine State AG+4d

Massachusetts State AG+7d

Maine State AG+7d

New Hampshire State AG+7d · this page

Pattern: first filing Jan 21 (IN), last Jan 28 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bard-associates-20220128.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 28, 2022
Raw hash: 13c7aee8fad9af27a2ee56d456e3c9105063800d772068e0a88deb29f4d2573c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBARD ASSOCIATES LLC

Victim entityBARD ASSOCIATES LLC

Incidentdiscovered Jan 10, 2022

Stated responseDisabled the unauthorized individual’s access to the affected email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov