AccidentalProfessional ServicesProfessional ServicesMisconfigurationCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

JFYNetWorks

bd_6934f7c1857689d3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 3, 2009

Filed

Jun 12, 2009

To disclose

9 days

Affected

6state residents only

Linked

2 filings

Confidence

66%

Full breach record for JFYNetWorks →

JFYNetWorks notified the NH Attorney General that an attacker gained access to a website application inadvertently accessible over the Internet on June 3, 2009. The attacker posted obscene messages and claimed to have acquired personal information, including Social Security numbers, of program applicants. Six New Hampshire residents were affected. JFYNetWorks disabled the website, reported the incident to law enforcement, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 days

Jun 3, 2009

Begins

Jun 3, 2009

Discovered

Jun 12, 2009

Filed

vs. sector median

17 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c15cee11e0d542b82009-06-15 · +3dVerified

Name: JFYNetWorks
norm: jfynetworks
Domain: jfynet.org

Name: JFYNetWorks
norm: jfynetworks
Domain: jfynet.org
Industry: Professional Servicesllm

Discovered: Jun 3, 2009
Breach occurred: Jun 3, 2009
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 12, 2009
Affected individuals: 6state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Attorney General Kelly A. Ayotte, Office of the Attorney General, NH
Initial access: exploit_public_facing

During the incident: Disabled the website and all links to the website application
Reported the incident to law enforcement authorities
Cooperating fully with their ongoing criminal investigation into the attack
Notifying all individuals whose information appeared in the database that was inadvertently accessible over the Internet
Changes made: Offering one year of free credit monitoring services and identity theft insurance provided by Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJun 12 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jfynetworks-20090612.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 12, 2009
Raw hash: 9c0438a275343a69c9ba9054e47b04f28ec5f4d59efb2bfc2d468cd8022549d7

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJFYNetWorks

Victim entityJFYNetWorks

Incidentdiscovered Jun 3, 2009

Stated responseDisabled the website and all links to the website application

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov