HackingProfessional ServicesFinancial ServicesProfessional ServicesStolen CredentialsRansomwareRansom DemandedRansom PaidData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)HighContained

Horizon Actuarial

bd_a31054ab3cd2acc4 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 12, 2021

Filed

Apr 22, 2022

To disclose

23 weeks

Affected

1,746state residents only

Linked

42 filings

Confidence

66%

Full breach record for Horizon Actuarial →10 incidents on file

Horizon Actuarial Services, LLC reported unauthorized access to its computer servers on Nov 10-11, 2021, after receiving a ransomware email on Nov 12, 2021. The company paid the attackers and notified the FBI. The breach exposed names, SSNs, DOBs, addresses, bank account/routing numbers, and medical plan info. This filing is a supplemental notice to the NH AG dated April 18, 2022, covering 1,746 NH residents.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 23 weeks / 161 days

Nov 10, 2021

Begins

Nov 12, 2021

Discovered

Apr 22, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 42 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_15610822e41f867e2022-05-10 · +18dVerified by operator
New Hampshire State AGbd_3140d98441aff7d22022-05-17 · +25dVerified by operator
California State AGbd_3343e2ff6ac461772022-05-18 · +26dVerified by operator
California State AGbd_0b8a8d1e0b2eb75a2022-05-24 · +32dVerified by operator

Show 6 more filings ↓up to 52d gap

Maine State AGbd_63ec2cad1130c87c2022-05-24 · +32dVerified
Hawaii State AGbd_a9ca9bbf0b626c3f2022-05-24 · +32dVerified by operator
New Hampshire State AGbd_797f45774e6898b62022-05-31 · +39dVerified by operator
Maine State AGbd_23ebf680da220cfe2022-06-09 · +48dVerified by operator
California State AGbd_531852585f7aeb412022-06-09 · +48dVerified by operator
New Hampshire State AGbd_a2e88f733f86ef672022-06-13 · +52dVerified by operator

Showing first 10 of 41 linked disclosures.

Name: Horizon Actuarial
norm: horizon actuarial
Domain: horizonactuarial.com

Name: Horizon Actuarial
norm: horizon actuarial
Domain: horizonactuarial.com
Industry: Professional ServicesllmFinancial Servicesllm

Discovered: Nov 12, 2021
Breach occurred: Nov 10, 2021 – Nov 11, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 18, 2022
Affected individuals: 1,746state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the FBIFiled notice with New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Initiated efforts to secure its computer system
Launched an investigation into the legitimacy of the claims in the email
Notified the FBI
Negotiated with and paid the group in exchange for an agreement that they would delete and not distribute or otherwise misuse the stolen information
Began mailing notice to affected individuals
Changes made: Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Advising individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank
Providing information on how to place a fraud alert and security freeze on one’s credit file
Providing contact details for the national consumer reporting agencies
Providing information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 4 states

View merged incident ↗

New Hampshire State AGApr 22 · first · this page

California State AG+18d

New Hampshire State AG+25d

California State AG+26d

California State AG+32d

Maine State AG+32d

Hawaii State AG+32d

New Hampshire State AG+39d

Maine State AG+48d

California State AG+48d

New Hampshire State AG+52d

Pattern: first filing Apr 22 (NH), last Jun 13 (NH) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 41 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/horizon-actuarial-20220422.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2022
Raw hash: 5a8d70b0a2057eaa62040df48a3e021c9c14a05009cd9c41758000a0bbac96b1

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityHorizon Actuarial

Victim entityHorizon Actuarial

Incidentdiscovered Nov 12, 2021

Stated responseInitiated efforts to secure its computer system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov