MalwareProfessional ServicesProfessional ServicesRansomwareCapture Stored DataRansom DemandedData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Group 1001 Resources, Inc.

bd_a558e29b4e2a910e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 9, 2023

Filed

Jul 28, 2023

To disclose

24 weeks

Affected

21state residents only

Linked

5 filings

Confidence

66%

Full breach record for Group 1001 Resources, Inc. →

Group 1001 Resources, LLC notified the NH Attorney General on July 28, 2023, of a ransomware incident detected on February 9, 2023. The attacker accessed and exfiltrated files containing personal information of approximately 21 New Hampshire residents, including names, SSNs, and driver's license numbers. The company engaged forensic investigators, notified the FBI, did not pay ransom, and provided 24 months of credit monitoring and identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 169 days

Feb 9, 2023

Discovered

Jul 10, 2023

Scope determined

Jul 28, 2023

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_5f1115811e558a142023-07-28Candidate
Indiana State AGbd_65835a216a3fe3792023-07-28Verified
Massachusetts State AGbd_b1f536c48449abd42023-07-28Verified
New Hampshire State AGbd_bfc6ac84104203c22023-11-21 · +116dVerified

Name: Group 1001 Resources, Inc.
norm: group 1001 resources

Name: Group 1001 Resources, Inc.
norm: group 1001 resources
Industry: Professional Servicesllm

Discovered: Feb 9, 2023
Materiality determined: Jul 10, 2023
Notification sent: Jul 28, 2023
Affected individuals: 21state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of InvestigationAlerted appropriate regulatory authorities

During the incident: Took steps to isolate and secure its systems and investigate the incident
Retained a leading third-party forensics firm to conduct a thorough investigation, secure its systems, remediate any risks, and methodically bring its systems back online
Alerted the Federal Bureau of Investigation and provided complete information regarding identified indicators of compromise
Did not pay a ransom
Scanned its systems for, and remediated, any identified indicators of compromise and rebuilt systems
Deployed additional advanced endpoint detection and monitoring tools on the newly restored systems
Sent notices via first class mail to the affected New Hampshire residents
Arranged to make credit monitoring and identity protection services by IDX available to the individual at no cost
Changes made: Deployed additional advanced endpoint detection and monitoring tools on the newly restored systems for an added layer of security and visibility across its network
Making infrastructure enhancements to continue to strengthen and harden the security posture of its network and systems
Offering identity theft protection services through IDX, A ZeroFox Company
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGJul 28 · first

Indiana State AGJul 28 · first

Massachusetts State AGJul 28 · first

New Hampshire State AGJul 28 · first · this page

New Hampshire State AG+116d

Pattern: first filing Jul 28 (ME), last Nov 21 (NH) — a 116-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/group-1001-resources-20230728.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2023
Raw hash: 15235111b16d44fc99cecabc453ebddefbd54f52daab19ed12bac7ea7c07aca9

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGroup 1001 Resources, Inc.

Victim entityGroup 1001 Resources, Inc.

Incidentdiscovered Feb 9, 2023

Stated responseTook steps to isolate and secure its systems and investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov