HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Greater Boston Legal Services, Inc.

bd_9bc29b4db213f3f6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 26, 2021

Filed

Sep 16, 2021

To disclose

12 weeks

Affected

60state residents only

Linked

5 filings

Confidence

66%

Full breach record for Greater Boston Legal Services, Inc. →

Greater Boston Legal Services (GBLS) notified the New Hampshire Attorney General of a data security incident occurring between June 24-26, 2021. An unauthorized third party may have accessed GBLS' network, potentially acquiring personal information of 60 New Hampshire residents, including names, SSNs, DOBs, and limited health information. GBLS secured its network, engaged forensic investigators, and sent notification letters offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 12 weeks / 82 days

Jun 24, 2021

Begins

Jun 26, 2021

Discovered

Sep 16, 2021

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_b174a8f9d7c8b1082021-09-14 · +2dVerified
Montana State AGbd_b3dddadad78b21042021-09-14 · +2dCandidate
Massachusetts State AGbd_f1561b7e7ef147a92021-09-14 · +2dVerified
Maine State AGbd_f9ba35ec9bd964362021-09-14 · +2dVerified

Name: Polsinelli PC
norm: polsinelli

Name: Greater Boston Legal Services, Inc.
norm: greater boston legal
Industry: Professional Servicesllm

Discovered: Jun 26, 2021
Breach occurred: Jun 24, 2021 – Jun 26, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 14, 2021
Affected individuals: 60state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Secured its computer network to prevent further access
Engaged a leading forensic security firm to investigate and confirm the overall security of GBLS’ computer systems
Notified the affected individuals by letter
Offered twelve (12) months of complimentary credit monitoring and identity theft protection
Providing notice of the incident via three (3) local media outlets and on its website homepage
Changes made: Implementing additional technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(82 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 14 · first

Montana State AGSep 14 · first

Massachusetts State AGSep 14 · first

Maine State AGSep 14 · first

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/greater-boston-legal-services-20210916.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2021
Raw hash: 72b901afadb8d581ce923ae949cf4623e0f98c93ba98e948db13aa9a9352a75d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPolsinelli PC

Victim entityGreater Boston Legal Services, Inc.

Incidentdiscovered Jun 26, 2021

Stated responseSecured its computer network to prevent further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov