MalwareManufacturingManufacturingRansomwareStolen CredentialsData ExfiltratedData EncryptedRansom DemandedTargetedIdentity (basic)Government IDMediumContained

Mount Vernon Mills, Inc

bd_72723af7cf01eca1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 1, 2022

Filed

Oct 14, 2022

To disclose

6 weeks

Affected

4state residents only

Linked

6 filings

Confidence

66%

Full breach record for Mount Vernon Mills, Inc →

Mount Vernon Mills notified the NH AG of a ransomware incident affecting 4 NH residents. Unauthorized actors accessed accounts via stolen credentials on Aug 20, 2022, encrypted servers, and exfiltrated PII (SSNs, names, DOBs, addresses). Data was sold on the dark web. Notification sent Oct 14, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

discovery → filing · 6 weeks / 43 days

Aug 20, 2022

Begins

Sep 1, 2022

Discovered

Oct 14, 2022

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteavoslockerbd_1cf55766dc704b782022-12-26 · +73dVerified by operator

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_c36efbdbed2e22e52022-10-14Verified by operator
Massachusetts State AGbd_ff24ce3361e753d62022-10-14Verified by operator
Oregon State AGbd_77bf9a6f4aa322912022-10-06 · +8dVerified by operator
Maine State AGbd_089cf08ea56de11e2022-10-03 · +11dCandidate

Name: Mount Vernon Mills, Inc
norm: mount vernon mills
Domain: mvmills.com

Name: Mount Vernon Mills, Inc
norm: mount vernon mills
Domain: mvmills.com
Industry: Manufacturingllm

Discovered: Sep 1, 2022
Breach occurred: Aug 20, 2022
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 14, 2022
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Contracted with a third outside firm to assist the Company with its efforts to mitigate the effects of the cyberattack and to prevent future cyberattacks
Improved security firewalls
Upgraded software versions
Changed all system passwords and strengthened security rules
Recovered or rebuilt the data that was subject to the cyberattack
Sent data breach notification letters to the affected individuals
Changes made: Improved security firewalls
Upgraded software versions
Changed all system passwords and strengthened security rules
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGOct 3 · first

Oregon State AG+3d

Indiana State AG+11d

Massachusetts State AG+11d

New Hampshire State AG+11d · this page

Pattern: first filing Oct 3 (ME), last Oct 14 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mount-vernon-mills-retirement-plans-20221014.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 14, 2022
Raw hash: 38ba5a5db2a92193b49f5af2a6adf453df51db338b08088468f6695e2dc2f182

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityMount Vernon Mills, Inc

Victim entityMount Vernon Mills, Inc

Incidentdiscovered Sep 1, 2022

Stated responseContracted with a third outside firm to assist the Company with its efforts to mitigate the effects of the cyberattack and to prevent future cyberattacks

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov