HackingManufacturingManufacturingCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Woodhaven Lumber

bd_80f9301aca883ed3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 22, 2022

Filed

Apr 20, 2023

To disclose

21 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Woodhaven Lumber →

Woodhaven Lumber & Millwork, Inc. notified the NH AG of unauthorized access to its systems between Nov 16-22, 2022, discovered Nov 22, 2022. One NH resident's name and financial account info were accessed. Response included forensic investigation, law enforcement notification, and 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d21 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 6 days

discovery → filing · 21 weeks / 149 days

Nov 16, 2022

Begins

Nov 22, 2022

Discovered

Apr 20, 2023

Filed

vs. sector median

+11 wks slower

This filing is one of 4 about the same incident.View merged incident

A leak claim by black_basta about this victim predates this filing by 42 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblack_bastabd_2cd6ee02a80baa912023-03-08 · +43dCandidate

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_71c146df03a528072023-03-10 · +41dVerified by operator
Indiana State AGbd_f8a5c18e67fe9c8c2023-03-10 · +41dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Woodhaven Lumber
norm: woodhaven lumber
Domain: woodhavenlumber.com
Industry: Manufacturingllm

Discovered: Nov 22, 2022
Breach occurred: Nov 16, 2022 – Nov 22, 2022
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 14, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement

During the incident: Took steps to secure its systems
Engaged third-party forensic specialists
Undertook a thorough programmatic and manual review of potentially affected files
Reviewed internal records to locate address information
Notified federal law enforcement
Provided access to credit monitoring services for twelve months through Experian
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Rotating passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 10 · first

Indiana State AGMar 10 · first

New Hampshire State AG+41d · this page

Pattern: first filing Mar 10 (MA), last Apr 20 (NH) — a 41-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/woodhaven-lumber-millwork-20230420.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 20, 2023
Raw hash: ebaf8505a7320a18fb8538e2f7de2992197cd7b55b9a1a60a2b4bbf541bd37dc

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityWoodhaven Lumber

Incidentdiscovered Nov 22, 2022

Stated responseTook steps to secure its systems

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov