MalwareFinancial ServicesFinanceRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumActive

CMS Companies

bd_a4067425fe79fa9c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 20, 2021

Filed

Feb 22, 2022

To disclose

31 weeks

Affected

51state residents only

Linked

3 filings

Confidence

66%

Full breach record for CMS Companies →

CMS Companies filed a supplemental notice with the New Hampshire AG regarding a July 20, 2021 malware incident. The breach affected 51 NH residents, exposing names, SSNs, and financial data. CMS engaged forensic specialists, notified law enforcement, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 31 weeks / 217 days

Jul 20, 2021

Begins

Jul 20, 2021

Discovered

Feb 22, 2022

Filed

vs. sector median

+22 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_66dd757594b023502022-02-04 · +18dCandidate
Indiana State AGbd_726c56ad0c3535392022-02-04 · +18dVerified

Name: CMS Companies
norm: cms companies
Domain: cmsco.com

Name: CMS Companies
norm: cms companies
Domain: cmsco.com
Industry: Financial Servicesllm

Discovered: Jul 20, 2021
Breach occurred: Jul 20, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 4, 2022
Affected individuals: 51state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notifying all relevant regulatorsReported this incident to federal law enforcement

During the incident: Moved quickly to investigate and respond to the incident
Assessed the security of CMS systems
Notify potentially affected individuals
Working cyber security specialists
Implementing additional safeguards
Providing additional training to its employees
Providing access to credit monitoring services for two (2) years through IDX
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Reported this incident to federal law enforcement
Notifying all relevant regulators
Changes made: Reviewing its security policies and procedures
Working with a cybersecurity specialist
Implementing additional measures and security tools
Providing employees with additional training regarding data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(217 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGFeb 4 · first

Indiana State AGFeb 4 · first

New Hampshire State AG+18d · this page

Pattern: first filing Feb 4 (ME), last Feb 22 (NH) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cms-20220222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2022
Raw hash: d3d98c938f1c653ce2f8c6c3b411c8e9f403c15aa53d760fa4ba5960d8049813

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCMS Companies

Victim entityCMS Companies

Incidentdiscovered Jul 20, 2021

Stated responseMoved quickly to investigate and respond to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov