HackingProfessional ServicesProfessional ServicesStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedGovernment IDPIIMediumContained

Legends International, LLC

bd_6b4fcd3a091c5f6d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 9, 2024

Filed

Apr 15, 2025

To disclose

22 weeks

Affected

1state residents only

Linked

5 filings

Confidence

67%

Legends International, LLC notified the New Hampshire Attorney General of a cybersecurity incident discovered on November 9, 2024. Unauthorized actors accessed Legends IT systems and acquired files containing the Social Security Number of one New Hampshire resident. Legends engaged external cybersecurity experts, notified law enforcement, and began notifying affected individuals on April 15, 2025, offering two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 weeks / 157 days

Nov 9, 2024

Discovered

Apr 15, 2025

Filed

vs. sector median

+4 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Nebraska State AGbd_0941589fada9d1132025-04-15Verified
Indiana State AGbd_5fe1780a43ad52142025-04-15Verified
Vermont State AGbd_9e98c97eef43aab42025-04-15Candidate
Massachusetts State AGbd_d9e0ffa9b8fbba802025-04-15Verified

Name: Legends International, LLC
norm: legends international
Domain: legendsglobal.com

Name: Legends International, LLC
norm: legends international
Domain: legendsglobal.com
Industry: Professional Servicesllm

Discovered: Nov 9, 2024
Materiality determined: —
Notification sent: Apr 15, 2025
Affected individuals: 1state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Law enforcement was also notified
Initial access: valid_credentials

During the incident: Took certain of its systems offline as a precaution
An investigation was launched with assistance from external cybersecurity experts
Law enforcement was also notified
Began notifying these individuals on April 15, 2025, via U.S. First Class Mail
Offering two years of free credit monitoring and identity theft protection services from Experian
Changes made: Took a series of steps to further strengthen its security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(157 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Nebraska State AGApr 15 · first

Indiana State AGApr 15 · first

Vermont State AGApr 15 · first

Massachusetts State AGApr 15 · first

New Hampshire State AGApr 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/legends-international-20250415.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2025
Raw hash: 776b14fa8f54ffda7652bba056a6d59c52f5942753798b03e8a5e000ecd33166

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLegends International, LLC

Victim entityLegends International, LLC

Incidentdiscovered Nov 9, 2024

Stated responseTook certain of its systems offline as a precaution

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov