HackingOtherStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Treeways Holdings LLC

bd_a7a935cc2557637c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 24, 2023

Filed

Jun 20, 2023

To disclose

17 weeks

Affected

6state residents only

Linked

4 filings

Confidence

66%

Full breach record for Treeways Holdings LLC →2 incidents on file

Treeways Holdings LLC notified the NH AG of a data event affecting 6 NH residents. Unauthorized access to an employee email account occurred Feb 6-24, 2023, discovered Feb 24. Personal info (names, addresses, SSNs, DOBs) was accessed. Treeways secured the tenant, investigated, and offered 12 months of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 18 days

discovery → filing · 17 weeks / 116 days

Feb 6, 2023

Begins

Feb 24, 2023

Discovered

Jun 20, 2023

Filed

vs. sector median

+8 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_30d9605c55157f992023-06-16 · +4dCandidate
Indiana State AGbd_6193cbc18aa4fefd2023-06-16 · +4dVerified
Massachusetts State AGbd_c3ffcc2cda504f592023-06-16 · +4dVerified

Name: Treeways Holdings LLC
norm: treeways holdings

Name: Treeways Holdings LLC
norm: treeways holdings
Industry: Otherllm

Discovered: Feb 24, 2023
Breach occurred: Feb 6, 2023 – Feb 24, 2023
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 16, 2023
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney GeneralProviding written notice of this incident to other relevant state regulators
Initial access: valid_credentials

During the incident: Immediately took steps to secure their email tenant
Launched an investigation to determine the nature and scope of the incident
Providing access to credit monitoring services through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to other relevant state regulators
Providing written notice to the three major credit reporting agencies
Changes made: Working to implement additional safeguards and training to its employees
Implementing additional security measures to further protect against similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJun 16 · first

Indiana State AGJun 16 · first

Massachusetts State AGJun 16 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/treeways-holdings-20230620.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2023
Raw hash: da9e08b396e0e45b75e01298b60940756537067c0a9d534a3748d9892a95635c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTreeways Holdings LLC

Victim entityTreeways Holdings LLC

Incidentdiscovered Feb 24, 2023

Stated responseImmediately took steps to secure their email tenant

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov