HackingOtherCustomer Data InvolvedPIIIdentity (basic)LowContained

North River Company

bd_a0dc45320f294b86 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 4, 2023

Filed

Oct 24, 2023

To disclose

7 weeks

Affected

2state residents only

Linked

4 records

Confidence

65%

Full breach record for North River Company →

North River Company notified the New Hampshire Attorney General on October 24, 2023, of a data security incident discovered on September 4, 2023. Unauthorized access to network data occurred in early September 2023, affecting 2 New Hampshire residents. Personal information was involved. North River engaged cybersecurity experts, secured systems, and offered 24 months of complimentary credit monitoring and identity theft restoration services via Kroll to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 7 weeks / 50 days

Sep 1, 2023

Begins

Sep 4, 2023

Discovered

Oct 24, 2023

Filed

vs. sector median

+1 wks slower

This filing is one of 4 records about the same incident.View merged incident

A leak claim by abyss about this victim was first seen 46 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteabyssbd_93880b3ebcb0dbd72023-09-08 · +46dCandidate

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_3bfde4e7e6064a332023-10-25 · +1dVerified
Maine State AGbd_64ad79968357b2b52023-10-25 · +1dCandidate

Name: North River Operating Company L.P.
norm: north river operating

Name: North River Company
norm: north river
Domain: northriverco.com
Industry: Otherllm

Discovered: Sep 4, 2023
Breach occurred: Sep 1, 2023 – Sep 7, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 24, 2023
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Engaged cybersecurity experts to assist with the process
Secured the affected systems
Launched an investigation
Notified law enforcement
Offered individuals complimentary services through Kroll, which include Credit Monitoring, $1 Million Identity Fraud Loss Reimbursement, Fraud Consultation, and Identity Theft Restoration
Established a toll-free call center through Kroll
Changes made: Implemented additional security measures in an effort to prevent a similar incident from occurring in the future
Enhanced network security and minimized the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 24 · first · this page

Massachusetts State AG+1d

Maine State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/north-river-company-20231024.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2023
Raw hash: 3c1f1709e218f69d39c1c63d7e3e4df8c83050de7948d99cac99d4896e6b0dd7

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityNorth River Operating Company L.P.

Victim entityNorth River Company

Incidentdiscovered Sep 4, 2023

Stated responseEngaged cybersecurity experts to assist with the process

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov