HackingTelecom & MediaInformationStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

USCC Services, LLC

bd_a6fee6ab93e3d4df · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 6, 2021

Filed

Jan 25, 2021

To disclose

19 days

Affected · nationwide

27623 in this filing

Linked

3 filings

Confidence

66%

Full breach record for USCC Services, LLC →6 incidents on file

USCC Services, LLC (d/b/a UScellular) reported a data breach in New Hampshire affecting 276 customers, including 23 state residents. Unauthorized individuals gained access to customer accounts via a phishing scam targeting retail employees, leading to credential compromise. Affected data included names, addresses, PINs, phone numbers, and service usage. UScellular reset credentials, changed customer PINs, and notified law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 19 days

Jan 4, 2021

Begins

Jan 6, 2021

Discovered

Jan 25, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_8e201178f23c79152021-01-22 · +3dCandidate
Maine State AGbd_c9f7dcb4be9dd7682021-01-22 · +3dCandidate

Name: USCC Services, LLC
norm: uscc services
Domain: uscellular.com

Name: USCC Services, LLC
norm: uscc services
Domain: uscellular.com
Industry: Telecom & Mediallm

Discovered: Jan 6, 2021
Breach occurred: Jan 4, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 22, 2021
Affected individuals: 276state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported the incident to law enforcement in accordance with the requirements of the Federal Communications Commission as well as certain state agencies
Initial access: phishing_link

During the incident: Removed the computer with the downloaded software from accessing the internet and then permanently removed it from use in the retail store
Reset the login credentials for every employee impacted in this incident at that retail store
Changed the impacted customers' PIN and security question/answer
Reported the incident to law enforcement in accordance with the requirements of the Federal Communications Commission as well as certain state agencies
Changes made: Encouraged customers to remain vigilant against phishing schemes
Encouraged customers to review account statements and monitor credit reports over the next 12 months
Provided information on how to place fraud alerts and security freezes on credit reports
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Oregon State AGJan 22 · first

Maine State AGJan 22 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/uscc-services-20210125.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 25, 2021
Raw hash: cee347e8c2cbd07ef52bb4f5f3c80fda3b0eb5c6d4e98a371060819e5f523041

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityUSCC Services, LLC

Victim entityUSCC Services, LLC

Incidentdiscovered Jan 6, 2021

Stated responseRemoved the computer with the downloaded software from accessing the internet and then permanently removed it from use in the retail store

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov