HackingTechnologyInformationVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsMediumContained

Green Wave Scientific, Inc.

bd_94b7f0734ab4dc75 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 28, 2015

Filed

Aug 10, 2015

To disclose

13 days

Affected

2,500

Confidence

66%

Full breach record for Green Wave Scientific, Inc. →

Green Wave Scientific, Inc. (via division Mohu) reported a security breach affecting ~2,500 customers. Unauthorized access occurred between June 3 and July 28, 2015, when a hacker compromised systems, inserted malicious code, and exfiltrated PII and credit card data. Discovered July 28, 2015. Notifications sent August 10, 2015. 4 NH residents affected. Response included forensic review, law enforcement cooperation (FBI, USSS), and 1-year credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 55 days

discovery → filing · 13 days

Jun 3, 2015

Begins

Jul 28, 2015

Discovered

Aug 10, 2015

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,500 affectedView incident

Name: Morningstar India
norm: morningstar india
Domain: morningstar.in

Name: Green Wave Scientific, Inc.
norm: green wave scientific
Industry: Technologyllm

Discovered: Jul 28, 2015
Breach occurred: Jun 3, 2015 – Jul 28, 2015
Undetected for: 55 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 10, 2015
Affected individuals: 2,500state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Reported the breach of security to the Federal Bureau of InvestigationReported the breach of security to the United States Secret ServiceReported the breach of security to appropriate state law enforcement agenciesNotified the Attorney General of New Hampshire
Initial access: exploit_public_facing

During the incident: Removed the malicious code from its systems
Adopted and implemented additional security measures to further protect its electronic systems
Hired two security consulting firms to review and make recommendations for further improving Mohu's electronic security measures
Reported the breach of security to the Federal Bureau of Investigation, the United States Secret Service, and appropriate state law enforcement agencies
Cooperating with these agencies in investigating the breach of security
Notified the major credit reporting agencies and its bank
Arranged for AllClear ID to provide one year of free credit monitoring services to each of its effected customers
Notifying each of its effected customers of the breach of security by US mail
Changes made: Implemented additional security measures designed to prevent a recurrence of such an attack
Working closely with major credit card suppliers and federal and state law enforcement to ensure the incident is properly addressed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/green-wave-scientific-20150810.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 10, 2015
Raw hash: 1f9dded604de459fc84bb5c7d4b386e1e31d61b5f17f6989ad61043a2aa31bd4

Reporting entityMorningstar India

Victim entityGreen Wave Scientific, Inc.

Incidentdiscovered Jul 28, 2015

Stated responseRemoved the malicious code from its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov