MalwareTechnologyInformationRansomwareStolen CredentialsMazeRansom DemandedRansom PaidData EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Vecima Networks

bd_853e41c2c07217a6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 2, 2020

Filed

Nov 12, 2020

To disclose

15 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Vecima Networks →

Vecima Networks reported a ransomware attack in New Hampshire affecting 1 resident. An unauthorized party used compromised credentials to access a VPN, deployed Maze ransomware, and encrypted files. Vecima paid a ransom and notified the resident on Nov 9, 2020. Data potentially exposed included name, address, SSN, and banking info. Remediation included firewall upgrades and server updates.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 18 days

discovery → filing · 15 weeks / 102 days

Jul 15, 2020

Begins

Aug 2, 2020

Discovered

Nov 12, 2020

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Norton Rose Fulbright US LLP
norm: norton rose fulbright us

Name: Vecima Networks
norm: vecima networks
Industry: Technologyllm

Discovered: Aug 2, 2020
Breach occurred: Jul 15, 2020 – Aug 2, 2020
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 9, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1078 Valid AccountsT1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Retained a forensic IT expert on August 6, 2020
Paid a ransom to the unauthorized third party
Conducted a thorough review of the information that may have been accessed
Notified affected New Hampshire residents on November 9, 2020
Offering them 24 months of complimentary credit monitoring and fraud protection services
Changes made: Upgrading the firewall to eliminate the critical vulnerability
Updating old servers
Transferring the old domain to the Vecima corporate domain that includes stronger password requirements with more frequent changes
Updating Antivirus software and verifying the installation on every server/computer
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(102 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/vecima-networks-20201112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2020
Raw hash: 0d10e707f8ec0a25c9fc1c40b07262021be5c973156d5616fa15b95b07b251b5

Reporting entityNorton Rose Fulbright US LLP

Victim entityVecima Networks

Incidentdiscovered Aug 2, 2020

Stated responseRetained a forensic IT expert on August 6, 2020

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov