MalwareTechnologyInformationRansomwareData ExfiltratedData EncryptedRansom DemandedData PublishedEmployee Data InvolvedGovernment IDIdentity (basic)PIIMediumContained

Whdh-Tv

bd_a0f7312edd44879e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 10, 2020

Filed

Dec 3, 2020

To disclose

8 weeks

Affected

40state residents only

Linked

3 filings

Confidence

66%

Full breach record for Whdh-Tv →

WHDH-TV, a Boston television station, notified the New Hampshire Attorney General of a security incident affecting 40 NH residents. In August 2020, a ransomware attack corrupted systems. On October 10, 2020, WHDH-TV discovered that attackers had also exfiltrated a database containing employee names, SSNs, and DOBs, which was posted on a black market site. WHDH-TV engaged forensic investigators, notified law enforcement, and provided 24 months of credit monitoring via Experian to affected individuals. The incident status is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 70 days

discovery → filing · 8 weeks / 54 days

Aug 1, 2020

Begins

Oct 10, 2020

Discovered

Dec 3, 2020

Filed

vs. sector median

11 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_33935d343715d9982020-12-01 · +2dVerified
Maine State AGbd_b5f9c7038e7342b12020-12-01 · +2dCandidate

Name: WHDH-TV / WLVN-TV
norm: whdh tv wlvn tv

Name: Whdh-Tv
norm: whdh tv
Industry: Technologyllm

Discovered: Oct 10, 2020
Breach occurred: Aug 1, 2020
Undetected for: 70 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 2, 2020
Affected individuals: 40state-resident count only
Data types: Government IDIdentity (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: phishing_link

During the incident: Hired a forensics firm to assist in further understanding the incident
Notified law enforcement
Arranged to have Experian help protect the affected individuals from identity theft
Provided 24 months of active credit monitoring, identity theft insurance, and identity repair services
Provided a toll-free telephone number for questions
Provided services and resources to employees whose personal information was not involved
Deployed VMware's cloud native Carbon Black Endpoint Detection and Response tool to all available WHDH-TV endpoints
Implemented additional security awareness training
Conducted a post-incident review
Changes made: Deployed VMware's cloud native Carbon Black Endpoint Detection and Response tool to all available WHDH-TV endpoints, including servers, laptops, and workstations
Implemented additional security awareness training
Conducted a post-incident review to assess its response to the incident and to identify areas where WHDH-TV policies and practices can be improved
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 1 · first

Maine State AGDec 1 · first

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/whdh-tv-20201203.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 3, 2020
Raw hash: 76a40dc4fdc0bc5840d84e8ee7f9395f500ac80df774369f422aedbe42a43be5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWHDH-TV / WLVN-TV

Victim entityWhdh-Tv

Incidentdiscovered Oct 10, 2020

Stated responseHired a forensics firm to assist in further understanding the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov