MalwareTechnologyProfessional ServicesInformationRansomwareData EncryptedTargetedIdentity (basic)Government IDEmploymentMediumContained

Collabera

bd_83c901139b1156f8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 8, 2020

Filed

Jul 17, 2020

To disclose

6 weeks

Affected

129state residents only

Linked

9 records

Confidence

66%

Full breach record for Collabera →

Collabera, Inc. reported a ransomware incident to New Hampshire. Unauthorized access began May 24, 2020, and was detected June 8, 2020. The incident likely impacted 129 NH employees' PII, including SSNs and DOB. Collabera restored data from backups, engaged forensic experts, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 6 weeks / 39 days

May 24, 2020

Begins

Jun 8, 2020

Discovered

Jul 17, 2020

Filed

vs. sector median

5 wks faster

This filing is one of 9 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemazebd_5d5bd239a535e0f92020-06-08 · +39dVerified by operator

Regulatory filings (7) · sorted by filing gap

Oregon State AGbd_534cb167d91a2bab2020-07-21 · +4dVerified
Massachusetts State AGbd_a1782f53e1d2060f2020-07-21 · +4dVerified
California State AGbd_b7536fb665576b4c2020-07-21 · +4dVerified
Indiana State AGbd_041bbb0ab945452d2020-07-10 · +7dVerified by operator

Show 3 more filings ↓up to 8d gap

Delaware State AGbd_8d1bb831591496b22020-07-10 · +7dVerified by operator
Washington State AGbd_889cc32e696bff5c2020-07-09 · +8dVerified
Montana State AGbd_e6483d8e749b4d982020-07-09 · +8dVerified

Name: Collabera
norm: collabera
Domain: collabera.com

Name: Collabera
norm: collabera
Domain: collabera.com
Industry: TechnologyllmProfessional Servicesllm

Discovered: Jun 8, 2020
Breach occurred: May 24, 2020
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2020
Affected individuals: 129state-resident count only
Data types: Identity (basic)Government IDEmployment
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire DOJ Consumer Protection Bureau

During the incident: Restored access to our data from backup files without having to obtain a decryption key
Removed the malware from the system
Launched an investigation to determine the nature and scope of this event
Working with outside forensic experts and law enforcement to conduct a more detailed review of the incident
Providing individual notifications
Offering credit monitoring and identity theft protection for two years
Changes made: Enhanced data security measures (data minimization, destruction and/or encryption)
Implementing new technical safeguards (additional firewalls, additional endpoint detection & response agents, additional multifactor authentication, additional logging and monitoring)
Changed passwords
Revised procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Washington State AGJul 9 · first

Montana State AGJul 9 · first

Indiana State AG+1d

Delaware State AG+1d

New Hampshire State AG+8d · this page

Oregon State AG+12d

Massachusetts State AG+12d

California State AG+12d

Pattern: first filing Jul 9 (WA), last Jul 21 (CA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/collabera-20200717.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 17, 2020
Raw hash: 06e1336d27fff154ec51a1a7ccbfd5d61ed58061075768195b76820d7e8a7061

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityCollabera

Victim entityCollabera

Incidentdiscovered Jun 8, 2020

Stated responseRestored access to our data from backup files without having to obtain a decryption key

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov