MalwareOtherRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedGovernment IDIdentity (basic)PHIMediumContained

A New Leaf, Inc.

bd_9293db60da31e5e3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 30, 2021

Filed

Jan 3, 2022

To disclose

40 weeks

Affected

2state residents only

Linked

6 filings

Confidence

67%

Full breach record for A New Leaf, Inc. →

A New Leaf, Inc. notified the New Hampshire Attorney General of a ransomware incident discovered on March 30, 2021. The attack encrypted files and resulted in the exfiltration of personal information, including names, Social Security numbers, and potentially PHI, affecting 2 New Hampshire residents. The organization engaged forensic investigators, implemented endpoint monitoring, and provided 12 months of credit monitoring to affected individuals. Notifications were mailed on December 30, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 40 weeks / 279 days

Mar 30, 2021

Discovered

Jan 3, 2022

Filed

vs. sector median

+32 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

HHS OCRbd_06f4302a57cf9dd82021-12-30 · +4dVerified
Massachusetts State AGbd_2aa6c1e6fbaac72b2021-12-30 · +4dVerified
Maine State AGbd_2c7c091fe98f26862021-12-30 · +4dVerified
Montana State AGbd_b6f649de0381726e2021-12-30 · +4dVerified

Show 1 more filing ↓up to 4d gap

Indiana State AGbd_c0ea290bddb4cfee2021-12-30 · +4dVerified

Name: A New Leaf, Inc.
norm: a new leaf

Name: A New Leaf, Inc.
norm: a new leaf
Industry: Otherllm

Discovered: Mar 30, 2021
Materiality determined: —
Notification sent: Dec 30, 2021
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)PHI
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Launched an internal investigation
Took steps to secure its systems
Engaged a third-party forensic security firm through legal counsel to investigate the incident and confirm the security of its computer systems
Implemented additional controls to reduce the risk of a similar incident, including the adoption of endpoint monitoring
Conducted a comprehensive review to determine if any personal information was involved and notified individuals accordingly
Changes made: Adoption of endpoint monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(279 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

HHS OCRDec 30 · first

Massachusetts State AGDec 30 · first

Maine State AGDec 30 · first

Montana State AGDec 30 · first

Indiana State AGDec 30 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/new-leaf-20220103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 3, 2022
Raw hash: 4205f239abf595c5e56b8ecdd723c5aa256ec5e9c69c3f57049d322a3478eceb

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityA New Leaf, Inc.

Victim entityA New Leaf, Inc.

Incidentdiscovered Mar 30, 2021

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov