MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

OSMOSE UTILITIES SERVICES, INC.

bd_78c79377cfb40275 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 13, 2020

Filed

Sep 4, 2020

To disclose

8 weeks

Affected

122state residents only

Linked

7 filings

Confidence

66%

Full breach record for OSMOSE UTILITIES SERVICES, INC. →2 incidents on file

Osmose Utilities Services, Inc. experienced a ransomware cyber attack on July 13, 2020, resulting in unauthorized access to systems containing employee data on July 10, 2020. The incident affected 122 New Hampshire residents, exposing names, Social Security numbers, health insurance information, and direct deposit details. Osmose secured systems, engaged forensic investigators, and is offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 8 weeks / 53 days

Jul 10, 2020

Begins

Jul 13, 2020

Discovered

Sep 4, 2020

Filed

vs. sector median

11 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_24b836c4a311828f2020-09-03 · +1dCandidate
California State AGbd_2a7570e66abab7c92020-09-03 · +1dVerified
Massachusetts State AGbd_5020ef05fe5766f82020-09-03 · +1dVerified
Indiana State AGbd_5cce121194e63de12020-09-03 · +1dVerified

Show 2 more filings ↓up to 1d gap

Oregon State AGbd_a8afd7e4cc20783e2020-09-03 · +1dVerified
Washington State AGbd_cba9ddf284408d422020-09-03 · +1dVerified

Name: Osmose Utilities Services, Inc.
norm: osmose utilities services

Name: OSMOSE UTILITIES SERVICES, INC.
norm: osmose utilities
Industry: Professional Servicesllm

Discovered: Jul 13, 2020
Breach occurred: Jul 10, 2020
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 3, 2020
Affected individuals: 122state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Immediately secured the affected systems
Launched an investigation to determine the nature and scope of the incident
Engaged a specialized cybersecurity firm to assist
Restored computer systems to fully operational
Conducted a comprehensive review of the contents of the affected systems
Began mailing notification letters to the New Hampshire residents
Offering eligible individuals a complimentary, one-year membership to credit monitoring and identity protection services
Established a dedicated, toll-free call center where individuals may obtain more information regarding the incident
Changes made: Implementing enhanced security measures
Providing additional training to employees
Enhancing existing security protocols
Re-educating employees for awareness on these types of incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGSep 3 · first

California State AGSep 3 · first

Massachusetts State AGSep 3 · first

Indiana State AGSep 3 · first

Oregon State AGSep 3 · first

Washington State AGSep 3 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/osmose-utilities-services-20200904.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2020
Raw hash: 7a54fa901aec3f201aeb65094a2d61bf5cae2a4633ce68fb3c6c0ee64833797a

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityOsmose Utilities Services, Inc.

Victim entityOSMOSE UTILITIES SERVICES, INC.

Incidentdiscovered Jul 13, 2020

Stated responseImmediately secured the affected systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov