HackingTechnologyProfessional ServicesInformationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedCredentialsPIILowResolved

flexPATH Strategies

bd_84f1cef05ba4ccb9 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 18, 2019

To disclose

—

Affected

97state residents only

Linked

9 filings

Confidence

67%

Full breach record for flexPATH Strategies →

FlexPATH Strategies, LLC submitted a supplemental notification to the NH Attorney General regarding a security incident involving unauthorized access to its employee email account. The incident affected 97 New Hampshire residents across multiple client organizations. FlexPATH provided notice to all affected individuals by April 5, 2019, and offered one year of credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Apr 18, 2019

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_0691b0e3d1dc7a912019-04-17 · +1dCandidate
New Hampshire State AGbd_e09a95a83b415f782019-03-18 · +31dVerified
Hawaii State AGbd_0172292eef70ab302019-03-15 · +34dVerified
Montana State AGbd_5c77e09d3d33f3b82019-03-15 · +34dCandidate

Show 4 more filings ↓up to 34d gap

Washington State AGbd_7a883bef71700ef02019-03-15 · +34dVerified
California State AGbd_956af0e49a3ab8c02019-03-15 · +34dVerified
Oregon State AGbd_be14e8f992f427b82019-03-15 · +34dVerified
Massachusetts State AGbd_fe1e38fc4db5a5a12019-03-15 · +34dVerified

Name: flexPATH Strategies
norm: flexpath strategies

Name: flexPATH Strategies
norm: flexpath strategies
Industry: TechnologyllmProfessional Servicesllm

Discovered: —
Materiality determined: —
Notification sent: Apr 5, 2019
Affected individuals: 97state-resident count only
Data types: CredentialsPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Submitted supplemental incident notification to New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Provided notice to additional New Hampshire residents on March 19, March 22, April 1, and April 5, 2019
Offered the individuals a complimentary, one-year membership to credit monitoring and identity theft protection services
Established a dedicated call center where all individuals may obtain more information regarding the incident
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Hawaii State AGMar 15 · first

Montana State AGMar 15 · first

Washington State AGMar 15 · first

California State AGMar 15 · first

Oregon State AGMar 15 · first

Massachusetts State AGMar 15 · first

New Hampshire State AG+3d

California State AG+33d

New Hampshire State AG+34d · this page

Pattern: first filing Mar 15 (HI), last Apr 18 (NH) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/flexpath-20190418.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 18, 2019
Raw hash: 9fb04dd60c5560e097452a697bb7c2341e781b4a7467f5a3ad4a84c68d183edf

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityflexPATH Strategies

Victim entityflexPATH Strategies

IncidentUnauthorized Access

Stated responseProvided notice to additional New Hampshire residents on March 19, March 22, April 1, and April 5, 2019

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov