MalwareFinancial ServicesFinanceRansomwareData MishandlingSupply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Caravus LLC

bd_8c13b776e6000fe9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 26, 2021

Filed

Jun 7, 2021

To disclose

6 weeks

Affected

20state residents only

Linked

5 filings

Confidence

66%

Full breach record for Caravus LLC →2 incidents on file

Caravus LLC notified the NH AG of a data event involving 20 NH residents. Legacy data (names, SSNs) remained on a third-party provider's (Netgain) server after a 2015 migration and was potentially accessed during Netgain's Nov 2020 ransomware incident. Caravus determined this on April 26, 2021, and notified residents on May 28, 2021, offering 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2307 days

discovery → filing · 6 weeks / 42 days

Jan 1, 2015

Begins

Apr 26, 2021

Discovered

Jun 7, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_487a45a21bdb402a2021-05-28 · +10dVerified
Montana State AGbd_70daf2399320562a2021-05-28 · +10dCandidate
Maine State AGbd_9114a5d451b23d6e2021-05-28 · +10dVerified by operator
Indiana State AGbd_d17144e345d55dfb2021-05-28 · +10dVerified

Name: Caravus LLC
norm: caravus

Name: Caravus LLC
norm: caravus
Industry: Financial Servicesllm

Discovered: Apr 26, 2021
Breach occurred: Jan 1, 2015 – Nov 30, 2020
Undetected for: 2,307 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 28, 2021
Affected individuals: 20state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney General
Third party: via Netgain Technology, LLC
Initial access: supply_chain

During the incident: Provided access to credit and identity monitoring services for one (1) year, through IDX
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
No longer using Netgain as a service provider
Changes made: Taking steps to further strengthen its policies, procedures and existing security measures, including the security measures in place at its third-party vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGMay 28 · first

Montana State AGMay 28 · first

Maine State AGMay 28 · first

Indiana State AGMay 28 · first

New Hampshire State AG+10d · this page

Pattern: first filing May 28 (MA), last Jun 7 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/caravus-20210607.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2021
Raw hash: ebce2987d58e94abb43655caab9ad2aa5bb1b5b111c464d2ab1e90c44e7cec6b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCaravus LLC

Victim entityCaravus LLC

Incidentdiscovered Apr 26, 2021

Stated responseProvided access to credit and identity monitoring services for one (1) year, through IDX

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov