HackingOtherCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Arabian Horse Association

bd_a6ca14e2b00a509a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2021

Filed

May 7, 2021

To disclose

14 days

Affected

19state residents only

Linked

8 filings

Confidence

66%

Full breach record for Arabian Horse Association →

The Arabian Horse Association (AHA) notified the New Hampshire Attorney General of a data security incident affecting prizewinners. Unauthorized access occurred between February 20 and March 31, 2021, discovered on April 23, 2021. The incident involved names, addresses, and Social Security numbers of 19 New Hampshire residents. AHA engaged cybersecurity experts, reported to the FBI, reset passwords, restricted access, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 62 days

discovery → filing · 14 days

Feb 20, 2021

Begins

Apr 23, 2021

Discovered

May 7, 2021

Filed

vs. sector median

6 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_4e876e7a0a62e5252021-05-07Verified
Maine State AGbd_071c302589ab29462021-05-08 · +1dVerified
Massachusetts State AGbd_cd2609a0dff1bd0e2021-05-11 · +4dVerified
Montana State AGbd_31d686d10b6e6f412021-05-02 · +5dCandidate

Show 3 more filings ↓up to 12d gap

Indiana State AGbd_c221006c815fa9982021-05-02 · +5dVerified
New Hampshire State AGbd_5208d648deabeb7f2021-05-18 · +11dVerified
Maine State AGbd_04b3983073ec99842021-05-19 · +12dVerified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Arabian Horse Association
norm: arabian horse
Industry: Otherllm

Discovered: Apr 23, 2021
Breach occurred: Feb 20, 2021 – Mar 31, 2021
Undetected for: 62 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 2, 2021
Affected individuals: 19state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Reported the matter to the Federal Bureau of Investigation (FBI)
Initial access: exploit_public_facing

During the incident: Engaged cybersecurity experts to assist with the investigation
Reported the matter to the Federal Bureau of Investigation (FBI)
Offered law enforcement whatever assistance is needed
Enhanced the security of our environment by adopting password management software
Installed endpoint protection software
Reset all passwords to employee accounts
Restricted network access
Offered affected individuals 12 months of credit monitoring and identity remediation services through IDX
Changes made: Adopting password management software
Installing endpoint protection software
Resetting all passwords to employee accounts
Restricting network access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Montana State AGMay 2 · first

Indiana State AGMay 2 · first

California State AG+5d

New Hampshire State AG+5d · this page

Maine State AG+6d

Massachusetts State AG+9d

New Hampshire State AG+16d

Maine State AG+17d

Pattern: first filing May 2 (MT), last May 19 (ME) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/arabian-horse-association-20210507.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2021
Raw hash: 80d8cabc5af111a264104b37f4613098a45e8f0904c9d4aa968827aed44456a8

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityArabian Horse Association

Incidentdiscovered Apr 23, 2021

Stated responseEngaged cybersecurity experts to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov