HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedIdentity (basic)LowContained

R. Zoppo Corp.

bd_a50701412fbac5f5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 8, 2024

Filed

Dec 24, 2024

To disclose

24 weeks

Affected

16state residents only

Linked

4 filings

Confidence

65%

Full breach record for R. Zoppo Corp. →

R. Zoppo Corp. notified the NH AG of a data breach involving unauthorized network access between June 19 and July 8, 2024. Approximately 16 New Hampshire residents had name information compromised. Zoppo engaged investigators, notified law enforcement, reset passwords, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d24 weeks discovery → filing

Incident timeline

undetected · 19 days

discovery → filing · 24 weeks / 169 days

Jun 19, 2024

Begins

Jul 8, 2024

Discovered

Nov 4, 2024

Scope determined

Dec 24, 2024

Filed

vs. sector median

+7 wks slower

This filing is one of 4 about the same incident.View merged incident

A leak claim by abyss about this victim predates this filing by 148 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteabyssbd_e40f84410d695a342024-07-28 · +149dVerified by operator

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8b088c126915f67b2024-12-24Verified
Maine State AGbd_8da78b0e419556342024-12-24Candidate

Name: R. Zoppo Corp.
norm: r zoppo
Domain: zoppo.com

Name: R. Zoppo Corp.
norm: r zoppo
Domain: zoppo.com
Industry: Professional Servicesllm

Discovered: Jul 8, 2024
Breach occurred: Jun 19, 2024 – Jul 8, 2024
Undetected for: 19 daysoccurrence → discovery
Materiality determined: Nov 4, 2024
Notification sent: Dec 23, 2024
Affected individuals: 16state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Conducted an investigation
Notified law enforcement
Changed network passwords
Reviewed its policies and procedures related to data protection
Offering all individuals complimentary credit monitoring and identity protection services
Changes made: Changed network passwords
Reviewed its policies and procedures related to data protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 24 · first

Maine State AGDec 24 · first

New Hampshire State AGDec 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/r-zoppo-20241224.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 24, 2024
Raw hash: 6d9ad5eadeb77d8e321d74163ce7a219359e8040f1f612331ff8ca0e6205b0b8

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityR. Zoppo Corp.

Victim entityR. Zoppo Corp.

Incidentdiscovered Jul 8, 2024

Stated responseConducted an investigation

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov