HackingTechnologyInformationVulnerability ExploitData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

BTU International, Inc.

bd_7bafccfd9b265bfc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 12, 2021

Filed

May 14, 2021

To disclose

5 weeks

Affected

83state residents only

Linked

7 filings

Confidence

67%

Full breach record for BTU International, Inc. →2 incidents on file

BTU International, Inc., a technology company, notified the New Hampshire Attorney General on May 13, 2021, of a security incident affecting 83 New Hampshire residents. On April 12, 2021, attackers exploited a vulnerability to access data and disable systems. Affected data included names, addresses, SSNs, and employment info. BTU engaged forensic investigators, disconnected networks, notified law enforcement, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 32 days

Apr 12, 2021

Discovered

May 14, 2021

Filed

vs. sector median

14 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_7502d8adf20dd2782021-05-13 · +1dCandidate
Massachusetts State AGbd_fdf7fd78c494e8f92021-05-13 · +1dVerified
Indiana State AGbd_c28150bce0bbb51a2021-07-13 · +60dVerified
Montana State AGbd_cdb2ef2fd43ab5312021-07-13 · +60dVerified

Show 2 more filings ↓up to 66d gap

Maine State AGbd_6266c3bd5d8303232021-07-15 · +62dVerified
New Hampshire State AGbd_6aec59ca20d42ee92021-07-19 · +66dVerified

Name: Faegre Drinker Biddle & Reath LLP
norm: faegre drinker biddle reath

Name: BTU International, Inc.
norm: btu international
Industry: Technologyllm

Discovered: Apr 12, 2021
Materiality determined: —
Notification sent: May 12, 2021
Affected individuals: 83state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Engaged external counsel
Retained a team of third-party forensic, incident response, and security professionals
Alerted law enforcement
Contained the threat by proactively disconnecting the affected networks
Sent written notification to affected employees and beneficiaries
Offered two years of free Experian credit monitoring service
Required a forced password reset for all endpoints and users
Strengthened certain network restrictions and privileges
Deployed Next Gen AV and Managed Detection & Response
Changes made: Deployed Next Gen AV and Managed Detection & Response
Strengthened certain network restrictions and privileges
Required a forced password reset for all endpoints and users
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Maine State AGMay 13 · first

Massachusetts State AGMay 13 · first

New Hampshire State AG+1d · this page

Indiana State AG+61d

Montana State AG+61d

Maine State AG+63d

New Hampshire State AG+67d

Pattern: first filing May 13 (ME), last Jul 19 (NH) — a 67-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/amtech-systems-20210514.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 14, 2021
Raw hash: ac5af8cb0a4be340619aa9f2b030b7cc11e02fa75bdf6bdf91eaeef427c83ad5

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityFaegre Drinker Biddle & Reath LLP

Victim entityBTU International, Inc.

Incidentdiscovered Apr 12, 2021

Stated responseEngaged external counsel

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov