AccidentalTechnologyRetail & ConsumerInformationMisconfigurationCustomer Data InvolvedIdentity (basic)PIILowContained

Over the Top Marketing (OTTM)

bd_95018cbf7a014e21 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 29, 2022

Filed

May 31, 2023

To disclose

26 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Over the Top Marketing (OTTM) →

Over The Top Marketing Corp notified NH DOJ of a misconfiguration incident where a publicly accessible cloud bucket exposed personal info (name, address, email, birth date) for 2 NH residents. Access occurred Oct 3-Nov 29, 2022. Discovery was Nov 29, 2022. Notifications sent May 26, 2023, with 2-year credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 57 days

discovery → filing · 26 weeks / 183 days

Oct 3, 2022

Begins

Nov 29, 2022

Discovered

May 31, 2023

Filed

vs. sector median

+7 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_293daac51edd88972023-05-30 · +1dVerified
Maine State AGbd_21bc746257c89ce02023-06-07 · +7dCandidate

Name: Over the Top Marketing (OTTM)
norm: over the top marketing ottm

Name: Over the Top Marketing (OTTM)
norm: over the top marketing ottm
Industry: TechnologyllmRetail & Consumerllm

Discovered: Nov 29, 2022
Breach occurred: Oct 3, 2022 – Nov 29, 2022
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 26, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)PII
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified NH Department of Justice

During the incident: Shutdown any access to the bucket on its computer system
Installed additional security protocols
Mailed Notification Letters via the United States Postal Service First Class Mail
Offered credit monitoring for two years
Worked to further enhance security of its networks
Changes made: Implemented enhanced security measures to help prevent this type of incident from recurring
Confirmed that the computer system vulnerability has been corrected
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(183 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMay 30 · first

New Hampshire State AG+1d · this page

Maine State AG+8d

Pattern: first filing May 30 (MA), last Jun 7 (ME) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/over-the-top-20230531.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 31, 2023
Raw hash: e5493903fe3a2b520091a52fdafefad5d20ba63072b96f274fff1eb411b4aacb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityOver the Top Marketing (OTTM)

Victim entityOver the Top Marketing (OTTM)

Incidentdiscovered Nov 29, 2022

Stated responseShutdown any access to the bucket on its computer system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov