MalwareTransportation & LogisticsTransportationRansomwareStolen CredentialsMaze GroupMazeData ExfiltratedRansom DemandedData PublishedCustomer Data InvolvedActor NamedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

VT San Antonio Aerospace, Inc.

bd_73faa8c0f0af963a · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 22, 2020

Filed

Aug 25, 2020

To disclose

14 weeks

Affected

12state residents only

Linked

2 filings

Confidence

68%

Full breach record for VT San Antonio Aerospace, Inc. →

VT San Antonio Aerospace, Inc. (SAA) was the target of a ransomware attack by the Maze Group. On May 22, 2020, SAA discovered servers infected with ransomware. The Maze Group demanded a ransom and claimed to have exfiltrated data. Forensic investigation confirmed data exfiltration prior to ransomware release. SAA refused to pay. The Maze Group published stolen data on their website between June 4 and July 6, 2020. Approximately 12 New Hampshire residents were affected. Exposed data included name, SSN, DOB, health information, passport number, and financial account numbers. SAA engaged forensic investigators, notified FBI and DoD, and implemented security enhancements including FireEye tools and Palo Alto firewall management. 24 months of credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 95 days

May 22, 2020

Discovered

Aug 25, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9468ed00f1fceac52020-08-24 · +1dVerified

Name: Norton Rose Fulbright US LLP
norm: norton rose fulbright us
Domain: stengg.com

Name: VT San Antonio Aerospace, Inc.
norm: vt san antonio aerospace
Domain: stengg.com
Industry: Transportation & Logisticsllm

Discovered: May 22, 2020
Materiality determined: —
Notification sent: Aug 25, 2020
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Ransomware· Maze Group
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: Maze GroupExternalFinancial
Regulator citations: Notified the Federal Bureau of InvestigationNotified the U.S. Department of DefenseNotified the Office of the New Hampshire Attorney General

During the incident: Launched an investigation
Engaged a leading cybersecurity and forensics firm
Notified the Federal Bureau of Investigation
Notified the U.S. Department of Defense
Refused to pay the ransom
Conducted a thorough review of the information published on the Maze Group website
Engaged a specialist vendor to assist with system recovery
Awarded a managed service contract to a third-party with qualified and certified Palo Alto engineers
Deployed advanced tools like FireEye HX technology across all SAA endpoints and servers
Deployed enhanced FireEye network and email security protections
Strengthened firewalls to include hardened configurations and improved logging capabilities
Changes made: Engaged a specialist vendor to assist with system recovery which include vulnerability and configuration hardening actions
Awarded a managed service contract to a third-party with qualified and certified Palo Alto engineers to improve the management of firewall protections
Deployed advanced tools like FireEye HX technology across all SAA endpoints and servers, monitored 24x7x365 by FireEye Security Operations Centre
Deployed enhanced FireEye network (NX/PX) and email security (ETP) protections
Strengthened firewalls to include hardened configurations and improved logging capabilities
Offering 24 months of complimentary credit monitoring and fraud protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(95 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGAug 24 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/vt-san-antonio-aerospace-20200825.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 25, 2020
Raw hash: 9540a03e7127b3139ca4a15c1c5a2d1928688e0c0833d9fb0e5d146e49f6798b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNorton Rose Fulbright US LLP

Victim entityVT San Antonio Aerospace, Inc.

Incidentdiscovered May 22, 2020

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov