HackingFinancial ServicesFinanceData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

AAA Collections

bd_8b08de040f3a3502 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 7, 2022

Filed

Nov 21, 2022

To disclose

11 weeks

Affected

7state residents only

Linked

7 filings

Confidence

66%

Full breach record for AAA Collections →

AAA Collections, Inc. (dba Advanced Asset Alliance) notified the New Hampshire AG of a cyber event where documents containing names and SSNs were copied between Sept 5-7, 2022. Discovered Sept 7, 2022. 7 NH residents affected. Response included law enforcement notification, credit monitoring via IDX, and employee training.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 11 weeks / 75 days

Sep 5, 2022

Begins

Sep 7, 2022

Discovered

Nov 21, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_1702940db03391382022-11-16 · +5dVerified
Maine State AGbd_313e59a39e7c2f782022-11-16 · +5dCandidate
Indiana State AGbd_7b2b39c9ae0e7b7a2022-11-16 · +5dVerified
Montana State AGbd_eb5c4f506d1e87ab2022-11-16 · +5dVerified

Show 2 more filings ↓up to 24d gap

Montana State AGbd_dc155d9622c967522022-12-15 · +24dVerified
HHS OCRbd_e26b84e2536107ce2022-12-15 · +24dVerified

Name: AAA Collections
norm: aaa collections

Name: AAA Collections
norm: aaa collections
Also named: AAA Collections, Inc.dba oflegal entity
Advanced Asset Alliancedba oftrade name
Industry: Financial Servicesllm

Discovered: Sep 7, 2022
Breach occurred: Sep 5, 2022 – Sep 7, 2022
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 16, 2022
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney Generalproviding written notice of this incident to relevant state regulatory authoritiesnotifying the three major credit reporting agencies, Equifax, Experian, and TransUnion

During the incident: Promptly took steps to secure its systems
Commenced an investigation into the nature and scope of the event
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for twelve (12) months, through IDX
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Enhance the security of its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Massachusetts State AGNov 16 · first

Maine State AGNov 16 · first

Indiana State AGNov 16 · first

Montana State AGNov 16 · first

New Hampshire State AG+5d · this page

Montana State AG+29d

HHS OCR+29d

Pattern: first filing Nov 16 (MA), last Dec 15 (SD) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aaa-collections-dba-advanced-asset-alliance-20221121.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2022
Raw hash: f71f04af970f4a0dd074bf8ceba1f1d5378cf9cb8c6f3217a940c7e6d1987106

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAAA Collections

Victim entityAAA Collections

Incidentdiscovered Sep 7, 2022

Stated responsePromptly took steps to secure its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov