HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Data Facts, Inc.

bd_7a9d06c698d68b79 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 5, 2018

Filed

Jan 28, 2019

To disclose

12 weeks

Affected

5state residents only

Linked

2 filings

Confidence

67%

Full breach record for Data Facts, Inc. →

Data Facts, Inc. notified the NH AG of an unauthorized access to an employee email account on Nov 5, 2018. The account contained PII (names, SSNs, DLs) for 5 NH residents. Data Facts reset passwords, hired forensic investigators, and offered 12 months of credit monitoring. Remediation included MFA and password reset protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 84 days

Nov 5, 2018

Discovered

Jan 28, 2019

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_a3de999be486f2ea2018-12-20 · +39dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Data Facts, Inc.
norm: data facts
Industry: Professional Servicesllm

Discovered: Nov 5, 2018
Materiality determined: —
Notification sent: Jan 18, 2019
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralProviding notice of this event to other state and federal regulators as requested
Initial access: valid_credentials

During the incident: Blocked access to the account by resetting passwords
Hired a leading forensics firm to help investigate
Conducted an extensive programmatic and manual review of the emails and attachments
Mailed written notice of this incident to five (5) New Hampshire residents
Offered 12 months of credit monitoring and identity restoration services at no cost
Changes made: Re-educating employees on cyber best practices
Implementing two-factor authentication for remote email access
Implemented a 60-day forced password reset protocol across all systems
Subscribed to an email security program for inbound and outbound filtering and blocking of emails potentially containing personally identifiable information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGDec 20 · first

New Hampshire State AG+39d · this page

Pattern: first filing Dec 20 (MT), last Jan 28 (NH) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/data-facts-20190128.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 28, 2019
Raw hash: 2c97fc8567b53dcb81e5e05f6efd558625f5c85b74c24f6ed1e4dddb96afaf4b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityData Facts, Inc.

Incidentdiscovered Nov 5, 2018

Stated responseBlocked access to the account by resetting passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov