HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

Flatirons Solutions

bd_aa23e343da6c4c73 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2023

Filed

Apr 14, 2023

To disclose

15 weeks

Affected

13state residents only

Linked

7 filings

Confidence

66%

Full breach record for Flatirons Solutions →

Flatirons Solutions, Inc. notified the NH AG of a data event affecting 13 NH residents. Unauthorized access occurred Dec 15, 2022–Jan 1, 2023. PII and government IDs impacted. Credit monitoring offered. Investigation ongoing.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d15 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 17 days

discovery → filing · 15 weeks / 103 days

Dec 15, 2022

Begins

Jan 1, 2023

Discovered

Apr 14, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 7 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 84 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_4d26750339779a682023-01-20 · +84dVerified by operator

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_44c849b4ff62f8a22023-04-10 · +4dCandidate
Vermont State AGbd_569a74daa5ff3de32023-04-10 · +4dVerified
Montana State AGbd_6cb938132d1dead32023-04-10 · +4dVerified
Maine State AGbd_af56eedc39a4ed232023-04-10 · +4dVerified

Show 1 more filing ↓up to 4d gap

Massachusetts State AGbd_f315a91ed9ff0c002023-04-10 · +4dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Flatirons Solutions
norm: flatirons solutions
Domain: flatironssolutions.com
Industry: Technologyllm

Discovered: Jan 1, 2023
Breach occurred: Dec 15, 2022 – Jan 1, 2023
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2023
Affected individuals: 13state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcementProviding written notice to relevant state and federal regulators
Initial access: valid_credentials

During the incident: Moved quickly to secure the systems and launched an investigation, with the assistance of third-party cybersecurity specialists
Notified federal law enforcement regarding the event and have assisted in their investigation
Providing access to credit monitoring services for twelve (12) months through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators, as necessary, and to the three major credit reporting agencies
Changes made: Working to implement additional safeguards and training to its employees
Reviewing protocols, policies, and procedures to reduce the likelihood of a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGApr 10 · first

Vermont State AGApr 10 · first

Montana State AGApr 10 · first

Maine State AGApr 10 · first

Massachusetts State AGApr 10 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/flatirons-solutions-20230414.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2023
Raw hash: 071d85a38dc5b83b2bf936ee231a24c831bb4c1c166da22e1fae4dd3fe75544c

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityFlatirons Solutions

Incidentdiscovered Jan 1, 2023

Stated responseMoved quickly to secure the systems and launched an investigation, with the assistance of third-party cybersecurity specialists

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov