MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedData ExfiltratedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

BACKROADS

bd_94c7105fbcd61d63 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 2, 2020

Filed

Nov 24, 2020

To disclose

8 weeks

Affected

16state residents only

Linked

7 filings

Confidence

67%

Full breach record for BACKROADS →

Backroads experienced a ransomware incident where files were encrypted and data was exfiltrated prior to encryption. The company became aware of suspicious activity on October 2, 2020. The breach affected 16 New Hampshire residents, exposing names, dates of birth, SSNs, government IDs, financial account info, and health insurance info. Backroads engaged forensic specialists, secured the network, and is rebuilding it. Credit monitoring is being offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 53 days

Oct 2, 2020

Discovered

Nov 24, 2020

Filed

vs. sector median

10 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_6eadb352e50544e02020-11-19 · +5dVerified
California State AGbd_7381ee0e20a518532020-11-19 · +5dVerified
Montana State AGbd_8d5027cb14bd22ed2020-11-19 · +5dCandidate
Maine State AGbd_b3d7644895863e402020-11-19 · +5dVerified

Show 2 more filings ↓up to 111d gap

California State AGbd_e286b5f31a42b0a52021-02-26 · +94dVerified
New Hampshire State AGbd_ac67e485d6963e4b2021-03-15 · +111dVerified

Name: Backroads
norm: backroads

Name: BACKROADS
norm: backroads
Industry: Professional Servicesllm

Discovered: Oct 2, 2020
Materiality determined: —
Notification sent: Nov 19, 2020
Affected individuals: 16state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Office of the New Hampshire Attorney General

During the incident: Began an investigation and worked with third party forensic specialists
Took steps to secure the network
Undertook a comprehensive review of the files to identify those whose personal information may have been accessible
Provided written notice of this incident to affected individuals
Providing access to credit monitoring services for one (1) year, through Epiq
Changes made: Rebuilding our network from the ground up
Adding further security measures
Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Massachusetts State AGNov 19 · first

California State AGNov 19 · first

Montana State AGNov 19 · first

Maine State AGNov 19 · first

New Hampshire State AG+5d · this page

California State AG+99d

New Hampshire State AG+116d

Pattern: first filing Nov 19 (MA), last Mar 15 (NH) — a 116-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/backroads-20201124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 24, 2020
Raw hash: cca3f115d13eeed52fa2e370dc75c9099c55b79e36c72eb6a8c7baef75710c04

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityBackroads

Victim entityBACKROADS

Incidentdiscovered Oct 2, 2020

Stated responseBegan an investigation and worked with third party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov