HackingTechnologyInformationStolen CredentialsPhishingData ExfiltratedMulti-Stage ChainCustomer Data InvolvedIdentity (basic)LowContained

Selling Simplified Group, Inc.

bd_92fa0ed1628a42a7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 20, 2023

Filed

Nov 22, 2023

To disclose

18 weeks

Affected

2state residents only

Confidence

66%

Full breach record for Selling Simplified Group, Inc. →

Selling Simplified Group, Inc. (SSG) notified the NH Attorney General of a breach affecting 2 NH residents. Unauthorized access occurred as early as May 10, 2023, via compromised credentials. SSG detected the incident on July 20, 2023, engaged forensic investigators, reset passwords, and enhanced security controls. Notices were sent on October 10, 2023, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 71 days

discovery → filing · 18 weeks / 125 days

May 10, 2023

Begins

Jul 20, 2023

Discovered

Nov 22, 2023

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Selling Simplified Group, Inc.
norm: selling simplified

Name: Selling Simplified Group, Inc.
norm: selling simplified
Industry: Technologyllm

Discovered: Jul 20, 2023
Breach occurred: May 10, 2023
Undetected for: 71 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 10, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1078.004 Cloud AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General John Formella
Initial access: valid_credentials

During the incident: Began investigating
Contacted law enforcement
Engaged a forensic firm to assess, mitigate, and restore these systems
Deployed additional security measures
SSG-wide password reset
Blocked the IP addresses and domains associated with the incident
Fine-tuned our email and web filtering
Enhanced our network monitoring and use of multi-factor authentication
Implemented a tiered privileged account model
Enhanced our default domain policy
Conducted dark web monitoring
Changes made: Deployed enhanced monitoring
Hardened our security systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(125 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/simplified-group-20231122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2023
Raw hash: 2d2fa5b331d1f6a8980bced46b8aee1dceeac6e256bb5cfc5a06fe24dd4fd9f7

Reporting entitySelling Simplified Group, Inc.

Victim entitySelling Simplified Group, Inc.

Incidentdiscovered Jul 20, 2023

Stated responseBegan investigating

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov