HackingManufacturingManufacturingStolen CredentialsPhishingCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

CLUB CAR, LLC

bd_98e757e876adfcf8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 12, 2021

Filed

Sep 20, 2021

To disclose

10 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for CLUB CAR, LLC →2 incidents on file

Club Car, LLC notified the NH AG of a security incident detected on July 12, 2021, involving unauthorized access to an employee email account. The incident affected PII (name, SSN) of employees and vendors, including one NH resident. Notifications were sent on September 17, 2021. Remediation included disabling legacy auth and implementing MFA.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 70 days

Jul 12, 2021

Discovered

Sep 20, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_7a462132d50a202c2021-09-17 · +3dVerified
Indiana State AGbd_af48f2bfc5926a662021-09-17 · +3dVerified

Name: Maynard Cooper Gale
norm: maynard cooper gale

Name: CLUB CAR, LLC
norm: club car
Domain: clubcar.com
Industry: Manufacturingllm

Discovered: Jul 12, 2021
Materiality determined: —
Notification sent: Sep 17, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Notified law enforcement
Engaged outside experts to investigate the situation
Notified affected individuals by mail
Changes made: Disabled legacy authentication
Created conditional access rules
Implemented multi-factor authentication
Prioritize cybersecurity awareness training with its users
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 17 · first

Indiana State AGSep 17 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/club-car-20210920.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2021
Raw hash: 2b3de56a51ca4c98538db50b7704c31f036b4d1db10b76c2da0afead3c97b021

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMaynard Cooper Gale

Victim entityCLUB CAR, LLC

Incidentdiscovered Jul 12, 2021

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov