Social EngineeringFinancial ServicesFinancePhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Supplemental Income 401 (k) Plan

bd_a5bb7ab96b54d4d4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 3, 2021

To disclose

—

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Supplemental Income 401 (k) Plan →

Supplemental Income 401(k) Plan notified NH AG of a phishing attack compromising a third-party administrator's email account. Unauthorized access occurred March 22–April 21, 2021. One NH resident's PII (name, SSN, DOB, financial data) was affected. The Plan retained forensic investigators, implemented security monitoring, and offered 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 22, 2021

Begins

Jun 3, 2021

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Washington State AGbd_5e44d79cff1322a62021-06-03Candidate
Montana State AGbd_7d25997d7574800f2021-06-04 · +1dVerified

Name: SEYFARTH SHAW LLP
norm: seyfarth shaw

Name: Supplemental Income 401 (k) Plan
norm: supplemental income 401 k plan
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Mar 22, 2021 – Apr 21, 2021
Materiality determined: —
Notification sent: Jun 4, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
Initial access: phishing_link

During the incident: A leading forensic firm was retained to assist in conducting a review of the incident
The Plan has taken additional security monitoring measures to help further protect against this type of incident going forward
Changes made: Providing individuals whose personal information was potentially affected by this incident with access to credit monitoring services for 24 months through Experian at no cost to the individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGJun 3 · first

New Hampshire State AGJun 3 · first · this page

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/supplemental-income-401k-plan-20210603.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2021
Raw hash: 57435f47db3c1ade4c8a5587bd358c689ca85a2ff86267ebba62feaf637191be

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySEYFARTH SHAW LLP

Victim entitySupplemental Income 401 (k) Plan

IncidentPhishing

Stated responseA leading forensic firm was retained to assist in conducting a review of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov