Social EngineeringPhishingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Retirement Clearinghouse
bd_88f5da311421de60 · schema v1 · pii pii-v1
Full breach record for Retirement Clearinghouse →Retirement Clearinghouse notified the NH AG of a data event affecting ~82 NH residents. Suspicious activity identified on an email account on March 15, 2023. Files containing PII (names, SSNs) were at risk of unauthorized access between March 15-16, 2023. Affected individuals received notices on May 12, 2023, and were offered 12 months of Experian credit monitoring.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_64cbb92c9ed4d3abMaine State AGfiled 2023-05-12(4d gap)Candidate
- bd_9cb3c2bea8f81f85Oregon State AGfiled 2023-05-12(4d gap)Verified
- bd_babae624a6907883Montana State AGfiled 2023-05-12(4d gap)Verified
- bd_e1b9cf14f5537d0dCalifornia State AGfiled 2023-05-12(4d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 4d gap
- bd_e44c3b51110a9ee6Vermont State AGfiled 2023-05-12(4d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/retirement-clearinghouse-20230516.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 16, 2023
- Raw hash
- 63f08097b6433c79e46c60184a4a16cc6c125030403b8f912eefe8eb69835644
Reporting entity
- Name
- Retirement Clearinghousenorm: retirement clearinghouse
Victim entity
- Name
- Retirement Clearinghousenorm: retirement clearinghouse
Incident
- Discovered
- Mar 15, 2023
- Materiality determined
- —
- Notification sent
- May 12, 2023
- Affected individuals
- 82
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Office of the New Hampshire Attorney GeneralNotified the three major credit reporting agencies, Equifax, Experian, and TransUnion
- Initial access
- phishing_link
Compliance
- Time to disclose
- 9 weeks(62 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.