MalwareTransportation & LogisticsTransportationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Keolis Commuter Services

bd_73a3e8dcab7d07c8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 15, 2020

Filed

Nov 12, 2020

To disclose

28 days

Affected

869state residents only

Linked

3 filings

Confidence

66%

Full breach record for Keolis Commuter Services →

Keolis Commuter Services experienced a ransomware event on October 10, 2020, affecting 869 New Hampshire residents. The incident involved the encryption of files and subsequent exfiltration of employee and dependent PII, including SSNs, driver's license numbers, and medical data. Keolis contained the breach by deactivating the network, notified law enforcement, and engaged forensic experts. Notifications were sent on November 10, 2020, offering two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 28 days

Oct 10, 2020

Begins

Oct 15, 2020

Discovered

Nov 12, 2020

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2ce0080b0b2684c42020-11-10 · +2dVerified
Maine State AGbd_5cdd081827aae8752020-11-10 · +2dCandidate

Name: MCLANE MIDDLETON, PROFESSIONAL ASSOCIATION
norm: mclane middleton professional

Name: Keolis Commuter Services
norm: keolis commuter
Domain: keoliscs.com
Industry: Transportation & Logisticsllm

Discovered: Oct 15, 2020
Breach occurred: Oct 10, 2020 – Oct 10, 2020
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 10, 2020
Affected individuals: 869state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Keolis has reported this matter to the Department of Homeland Security ("DHS")

During the incident: Deactivated its network within a few hours
Immediately notified law enforcement and MBTA
Hired an outside computer security forensic expert to help investigate and remediate
Restored its network to normal operations by Tuesday, October 13, 2020
Informed all employees about the matter
Provided all current and former employees, together with all of the dependents listed in the potentially compromised files, with a free, two-year membership in Experian IdentityWorks
Provided affected individuals with a toll free telephone hotline and email
Changes made: Deployed additional threat detection software
Mandated password changes
Replacing certain hardware within the IT environment
Created geolocation restrictions associated with remote access
Evaluating further technical monitoring options
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 10 · first

Maine State AGNov 10 · first

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/keolis-commuter-20201112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2020
Raw hash: 96ce55d7f607537bd329175a0bed20a9efb14a2e21712f420f6d023616642fca

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMCLANE MIDDLETON, PROFESSIONAL ASSOCIATION

Victim entityKeolis Commuter Services

Incidentdiscovered Oct 15, 2020

Stated responseDeactivated its network within a few hours

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov