Social EngineeringHealthcareHealthcarePhishingBECCustomer Data InvolvedPIIIdentity (basic)LowContained

Crossroads for Women

bd_a8a9e82f278ad2a7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 25, 2023

Filed

Jan 22, 2024

To disclose

21 weeks

Affected · nationwide

2835 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Crossroads for Women →2 incidents on file

Crossroads for Women, a behavioral health treatment provider, notified the NH AG of a business email compromise discovered on August 25, 2023. The incident affected 283 individuals total, including 5 New Hampshire residents. PII was potentially accessed. Notifications were mailed on January 17, 2024, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 150 days

Aug 25, 2023

Begins

Aug 25, 2023

Discovered

Jan 22, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_a20f1b4581e0b3512024-01-17 · +5dCandidate

Name: Wilson Elser Moskowitz Edelman and Dicker LLP
norm: wilson elser Moskowitz Edelman and Dicker
Domain: crossroadsabq.org

Name: Crossroads for Women
norm: crossroads for women
Domain: crossroadsabq.org
Industry: Healthcarellm

Discovered: Aug 25, 2023
Breach occurred: Aug 25, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 17, 2024
Affected individuals: 283state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Secured the account
Conducted an investigation
Changed all user credentials
Enhanced the security measures
Offered complimentary credit monitoring and identity theft restoration services through Cyberscout
Changes made: Enhanced the security measures
Took steps and will continue to take steps to mitigate the risk of future harm
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(150 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGJan 17 · first

New Hampshire State AG+5d · this page

Pattern: first filing Jan 17 (VT), last Jan 22 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/crossroads-women-20240122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 22, 2024
Raw hash: 78bea7b0e72626c86c665473102c80aac59ab6b7ccb08e528cd51a609c16bc25

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWilson Elser Moskowitz Edelman and Dicker LLP

Victim entityCrossroads for Women

Incidentdiscovered Aug 25, 2023

Stated responseSecured the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov