MalwareTelecom & MediaInformationRansomwareData EncryptedTargetedIdentity (basic)Government IDMediumContained

Shawmut Communications Group

bd_9a58f930525adcb4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 26, 2021

Filed

Feb 14, 2022

To disclose

16 weeks

Affected

18state residents only

Linked

3 filings

Confidence

67%

Full breach record for Shawmut Communications Group →

Shawmut Communications Group notified the NH AG of a ransomware incident discovered Oct 26, 2021. Malware encrypted files and unauthorized access occurred. 18 NH residents affected (names, SSNs, DOBs, addresses). Shawmut engaged forensic specialists, enhanced security, and provided 2 years of credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 111 days

Oct 26, 2021

Discovered

Feb 14, 2022

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_0543b7ef165283252022-02-08 · +6dVerified
Maine State AGbd_b4d8b184b303e2f92022-02-08 · +6dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Shawmut Communications Group
norm: shawmut communications
Industry: Telecom & Mediallm

Discovered: Oct 26, 2021
Materiality determined: —
Notification sent: Feb 8, 2022
Affected individuals: 18state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial

During the incident: Launched an investigation with the assistance of third-party computer forensics specialists
Implemented additional security measures
Reviewing and enhancing existing policies and procedures
Providing access to credit monitoring services for two years, through IDX
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing additional technical security measures designed to mitigate recurrence
Reviewing and enhancing existing data privacy policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(111 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 8 · first

Maine State AGFeb 8 · first

New Hampshire State AG+6d · this page

Pattern: first filing Feb 8 (MA), last Feb 14 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shawmut-communications-group-20220214.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2022
Raw hash: cd6ffcd03b9afa54d11380131e0197348075258b491675a7c1d8b95e6be3889d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityShawmut Communications Group

Incidentdiscovered Oct 26, 2021

Stated responseLaunched an investigation with the assistance of third-party computer forensics specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov