HackingOtherDelayed DiscoveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Metropolitan Realty Group

bd_7e2323e8b24eb5bd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 26, 2020

Filed

Nov 15, 2021

To disclose

51 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Metropolitan Realty Group →

Metropolitan Realty Group discovered unusual activity on its servers on November 26, 2020. Investigation determined unauthorized access occurred between September 3 and November 27, 2020. Approximately 2 New Hampshire residents were affected, with name and Social Security number potentially compromised. The company disconnected affected systems, engaged third-party specialists, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 84 days

discovery → filing · 51 weeks / 354 days

Sep 3, 2020

Begins

Nov 26, 2020

Discovered

Nov 15, 2021

Filed

vs. sector median

+43 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_5f9291142184ae1a2021-11-10 · +5dCandidate
Indiana State AGbd_c12d7c8aed4fcde62021-11-10 · +5dVerified
Massachusetts State AGbd_c96348833f85bddf2021-11-10 · +5dVerified

Name: Metropolitan Realty Group
norm: metropolitan realty

Name: Metropolitan Realty Group
norm: metropolitan realty
Industry: Otherllm

Discovered: Nov 26, 2020
Breach occurred: Sep 3, 2020 – Nov 27, 2020
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 10, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unknown
Threat actor: External
Regulator citations: Notifying relevant state regulators, as required

During the incident: Disconnected the servers and workstations from the network
Commenced a comprehensive forensic investigation
Initiated a comprehensive review of all potentially affected information with the assistance of third-party data review specialists
Notified law enforcement
Provided notice on its website on May 27, 2021
Provided notice to statewide media in New York on September 3, 2021
Began providing written notice of this incident to potentially affected individuals on or about November 10, 2021
Offering access to complimentary credit monitoring and identity protection services through Equifax
Changes made: Working to implement additional safeguards and training to its employees
Reviewing and enhancing its existing policies and procedures
Taking steps to enhance its security posture going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 51 weeks(354 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGNov 10 · first

Indiana State AGNov 10 · first

Massachusetts State AGNov 10 · first

New Hampshire State AG+5d · this page

Pattern: first filing Nov 10 (ME), last Nov 15 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/metropolitan-realty-20211115.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 15, 2021
Raw hash: 75929cf5156955001c2d4797ed8482b81fceadb848bd0d7f1d026a98198e1a68

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMetropolitan Realty Group

Victim entityMetropolitan Realty Group

Incidentdiscovered Nov 26, 2020

Stated responseDisconnected the servers and workstations from the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov