HackingTransportation & LogisticsTransportationCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Government IDMediumActive

CommuteAir •

bd_719293061db8f4cb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 17, 2023

Filed

Jan 24, 2023

To disclose

7 days

Affected

4state residents only

Linked

5 filings

Confidence

67%

Full breach record for CommuteAir • →2 incidents on file

CommuteAir, LLC notified the New Hampshire Attorney General on January 24, 2023, of a cybersecurity incident discovered on January 17, 2023. A security researcher identified an unsecured development server containing employee PII, including names, DOBs, addresses, and partial SSNs. Four New Hampshire residents were affected. CommuteAir took the server offline, reset credentials, engaged Mandiant for forensic analysis, and reported the incident to CISA.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 days

Jan 17, 2023

Discovered

Jan 24, 2023

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_3902fc58e6d17f7b2023-01-24Verified
Montana State AGbd_f97d3e23762591f82023-01-23 · +1dCandidate
Massachusetts State AGbd_51350807068828ae2023-01-26 · +2dVerified
Indiana State AGbd_da1bc0c05c4d3c812023-01-18 · +6dVerified

Name: CommuteAir •
norm: commuteair
Domain: commuteair.com

Name: CommuteAir •
norm: commuteair
Domain: commuteair.com
Industry: Transportation & Logisticsllm

Discovered: Jan 17, 2023
Materiality determined: —
Notification sent: Jan 24, 2023
Affected individuals: 4state-resident count only
Data types: PIIIdentity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the Office of the Attorney General of New HampshireReported the exposure to the Cybersecurity and Infrastructure Security Agency (CISA)
Initial access: exploit_public_facing

During the incident: Took the affected server immediately offline
Reset credentials related to the server
Started an investigation to determine the extent of data access
Employed firewall changes to prevent the exposure of the development server to the internet
Changed account passwords that were potentially exposed via the server
Retained a third-party cybersecurity firm to gather and analyze forensic data
Reported the exposure to the Cybersecurity and Infrastructure Security Agency (CISA)
Changes made: Working with Mandiant to modernize systems and protocols
Implementing additional security standards
Upgrading and hardening systems throughout 2023
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 18 · first

Montana State AG+5d

Maine State AG+6d

New Hampshire State AG+6d · this page

Massachusetts State AG+8d

Pattern: first filing Jan 18 (IN), last Jan 26 (MA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/commuteair-20230124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2023
Raw hash: bb52b8526ba0192b8b04c709247f1305c4406010a8ebc518faa91c01c7082190

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCommuteAir •

Victim entityCommuteAir •

Incidentdiscovered Jan 17, 2023

Stated responseTook the affected server immediately offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov